[ChrisSc]

Problem

make rebuild fails at stage 5/20 (install-tools.sh → cargo-binstall) on WSL2 / Docker Desktop, while the same build succeeds on macOS.

The failure looks like a slow network but is actually a latent defect:

1. This host's WSL2/Docker-Desktop NAT chokes cargo-binstall's concurrent fetcher checks — ~20 simultaneous outbound connections is the measured ceiling. Resolving all 11 crates at once (~22 connections × GitHub + QuickInstall fetchers) tips over it, so the lookups time out (WARN resolve: Timeout reached while checking fetcher … deadline has elapsed, in 15s waves).
2. With every binary fetcher exhausted, cargo-binstall falls back to compile-from-source — which hard-fails the build:
   • this image ships no Rust toolchain, and
   • the source path rejects --install-path:

     ERROR Fatal error:
       × For crate bottom: cargo-install does not support `--install-path`
     exit code: 100  →  make: *** [Makefile:21: rebuild] Error 1
     

macOS has no equivalent NAT layer, so it never trips the blip and never reaches the broken fallback.

Fix

Three guards on the cargo-binstall invocation, all no-ops on a healthy host (macOS unaffected):

• --disable-strategies compile — never take the broken source-compile path. All 11 crates publish prebuilt binaries, so compile is never legitimately needed here.
• Batches of 4 (~8 concurrent connections, well under the ~20 ceiling) instead of all 11 at once — addresses the root mechanism.
• Retry each batch + --maximum-resolution-timeout 60 — rides out any residual transient NAT/DNS blip; the cargo cache mount keeps retries cheap.

Verification

• Isolated BuildKit repro of the stage: 3 batches, ~2s each, zero timeouts, zero source fallback, all 11 binaries installed.
• Full make rebuild: exit 0, image exported, claude-code Up (healthy).
• shellcheck clean (the only CI gate this shell-script change touches; Dockerfile/YAML untouched).

🤖 Generated with Claude Code