first round of changes: dedicated cache folder, cleaner base image, version management

Dockerfile.base

@@ -5,18 +5,24 @@
 # This image runs as root so project Dockerfiles can install system packages
 # freely. Don't worry — the launcher locks things down at run time (normal user,
 # no special privileges), so nothing Claude does actually runs as root.
-FROM node:22-slim
+#
+# Debian (slim) as the base: small, stable, and its apt packages behave
+# predictably in a container — notably `chromium` is a real package here, unlike
+# on Ubuntu where it's a snap stub that won't run in a container.
+FROM debian:bookworm-slim
 
 # Just the basics every project needs:
 #   - curl/ca-certificates: for downloads (the Claude installer, git-spice)
 #   - git + ripgrep: required by Claude Code
+# We leave apt's package lists in place (no cleanup) so a project Dockerfile can
+# install packages without re-fetching them — though it should still run its own
+# `apt-get update` first, since this base image may be days or weeks old.
 RUN apt-get update && apt-get install -y --no-install-recommends \
     curl \
     ca-certificates \
     git \
     ripgrep \
-    bash \
-    && rm -rf /var/lib/apt/lists/*
+    bash
 
 # --- git-spice (a tool for stacked pull requests, handy in the Claude workflow) ---
 # Releases are named git-spice.Linux-<arch>.tar.gz, and `uname -m` gives the arch.