DEVX-84: refactor: remove hadolint on-the-fly install from setup-image

AGENTS.md

@@ -4,8 +4,8 @@
 
 ```bash
 make setup           # Create venv, install deps, set up hooks, install CI tools
-make install-tools   # Install actionlint, git-cliff, act_runner to ~/.local/bin
-make lint-all        # ruff + pyright + bandit + actionlint
+make install-tools   # Install actionlint, git-cliff, act_runner, tea, hadolint to ~/.local/bin
+make lint-all        # ruff + pyright + bandit + actionlint + lint-dockerfiles
 make pytest-cov      # Unit tests with 100% coverage enforcement
 make test-unit       # Unit tests without coverage
 make workflow-lint   # Static lint of .gitea/workflows/*.yml (actionlint)
@@ -16,7 +16,7 @@ make clean           # Remove caches, build artifacts, coverage data
 
 `make setup` automatically installs all development tools:
 - **Python deps** via `python -m devx.tools.setup` (pip install -e .[dev], pre-commit hooks)
-- **actionlint, git-cliff, act_runner, tea** via `python -m devx.tools.install_tools` (CI/CD tools to ~/.local/bin)
+- **actionlint, git-cliff, act_runner, tea, hadolint** via `python -m devx.tools.install_tools` (CI/CD tools to ~/.local/bin)
 - **tea CLI login** via `python -m devx.tools.setup` (configures `tea login` from `.env` `CI_GITEA_TOKEN`)
 
 ## Workflow Verification (Before Push)
@@ -73,7 +73,7 @@ src/devx/
 │   └── doc_coverage.py  # Documentation coverage check
 ├── tools/               # Developer tooling modules (run locally or by CI)
 │   ├── setup.py         # Environment setup (venv, deps, hooks)
-│   ├── install_tools.py # Install actionlint, git-cliff, act_runner, tea
+│   ├── install_tools.py # Install actionlint, git-cliff, act_runner, tea, hadolint
 │   ├── install_checkmake.py  # Install checkmake (Makefile linter)
 │   ├── build_image.py   # Build and push Docker images to Gitea registry
 │   ├── clean_images.py  # Clean up old Docker image versions from Gitea registry
@@ -404,7 +404,7 @@ projects.
 | `devx-venv` | Create Python venv with version check |
 | `devx-activate-scripts` | Create shell/fish/zsh activate scripts |
 | `devx-install-hooks` | Set git hooks path to hooks/ |
-| `devx-install-tools` | Install actionlint, git-cliff, act_runner, tea |
+| `devx-install-tools` | Install actionlint, git-cliff, act_runner, tea, hadolint |
 | `devx-install-checkmake` | Install checkmake (Makefile linter) |
 | `devx-checkmake` | Lint Makefiles with checkmake |
 | `devx-workflow-lint` | Static lint of Gitea Actions YAML (actionlint) |
@@ -453,7 +453,7 @@ to eliminate the 40-120s setup tax on every CI job:
 | Image | Contains | Used by jobs |
 |-------|----------|-------------|
 | `ci-base-latest` | Python 3.12 + devx[ci] + tea | detect-changes, detect-type, validate-commit-msg, pr-review, auto-merge, sync-wiki, vikunja, configure-repo |
-| `ci-quality-latest` | ci-base + devx[lint] + actionlint + checkmake | quality, badges |
+| `ci-quality-latest` | ci-base + devx[lint] + actionlint + checkmake + hadolint | quality, badges |
 | `ci-full-latest` | ci-quality + devx[release,molecule,deploy] + git-cliff + OpenTofu | release, publish, release-dry-run, molecule-tests, deploy jobs |
 
 **Build process** (in `build-images.yml` workflow):

Makefile

@@ -33,8 +33,6 @@ setup-release: $(VENV)/bin/activate .env
 # Setup for pre-built image jobs (deps already in image, just link venv + install project)
 setup-image:
 	@if [ -d /opt/venv ]; then ln -sf /opt/venv .venv; . .venv/bin/activate && pip install -e . --no-deps 2>/dev/null; \
-		export PATH="$$HOME/.local/bin:$$PATH"; \
-		python3 -m devx.tools.install_tools --tool hadolint 2>/dev/null || true; \
 	else echo "[setup-image] /opt/venv not found — falling back to setup-ci"; $(MAKE) setup-ci; fi
 
 .env: