Release 2.1.156 (2026-07-22)

Bug fixes

• pin UV_LINK_MODE=copy to silence uv hardlink-fallback warning (#2463) uv's cache lives on the container overlay fs while the venv target is the bind-mounted /workspace, so uv cannot hardlink and falls back to a full copy, printing a warning on every install in every run. Pin UV_LINK_MODE=copy in the vrg-container-run environment to suppress the noise; uv already copies here, so this is a zero-behaviour-change suppression. An explicit host UV_LINK_MODE still wins so operators can override. Ref #2461.

Features

• provision the dev image explicitly before validation (#2464) vrg-finalize-pr previously let the post-finalization validation cold-rebuild the target-branch dev image inside the validation stage: ensure_cached_image runs on the first vrg-container-run whose cache key no longer matches, so a build-time glitch surfaced as 'validation failed after a clean merge', independent of the repo's actual state.

Make provisioning an explicit prerequisite. A new fail_fast 'provision' stage runs between cleanup (which advances the target branch, the one deterministic reason its image needs rebuilding) and validation, warming the image once via a shared provision_dev_image helper so validation and the next PR's work reuse a warm image instead of racing a cold rebuild mid-operation.

Any environment build is now clearly attributed: _build_cached_image prints a 'Provisioning dev image (environment build - not part of your command)' banner, so a provisioning failure stays attributable to provisioning rather than masquerading as the caller's operation. The lazy path keeps auto-building (no hard user-facing gate); it is only made deterministic-early and visible.

Does not cure the underlying ansible-lint/Python-3.14 metadata glitch that first surfaced this (tracked in vergil-containers#446); it removes the mid-operation rebuild and the mis-attribution. Ref #2462.

CI Evidence: All gates passed — full audit bundle available. Download →