fix(deploy): make clone installer build dependencies reliably

Dockerfile

@@ -2,7 +2,8 @@ FROM golang:1.26.5-bookworm AS build
 
 WORKDIR /src
 COPY go.mod go.sum ./
-RUN go mod download
+ARG GOPROXY=https://goproxy.cn,direct
+RUN GOPROXY=$GOPROXY go mod download
 COPY . ./
 
 ARG VERSION=dev

deploy/dobotai-dingtalk/README.md

@@ -131,6 +131,8 @@ dobotai-dingtalk:local-<当前Git短SHA>
 
 镜像名、PostgreSQL镜像和构建元数据只由根目录`install-docker.sh`维护，用户不传`DOBOTAI_IMAGE`。脚本完成后数据库和迁移已就绪，应用尚未启动。然后执行：
 
+构建期Go依赖使用脚本内置的公开模块代理`https://goproxy.cn,direct`；它只存在于镜像构建命令，不写入DobotAI运行配置。
+
 ```bash
 sudo dobotai-dingtalk-configure
 ```

install-docker.sh

@@ -52,6 +52,7 @@ image="dobotai-dingtalk:local-${commit_short}"
 
 echo "[1/3] 构建 DobotAI 镜像：$image"
 docker build \
+  --build-arg "GOPROXY=https://goproxy.cn,direct" \
   --build-arg "VERSION=local-${commit_short}" \
   --build-arg "COMMIT_SHA=${commit_sha}" \
   --build-arg "BUILD_TIME=${build_time}" \

scripts/containerized_deployment_test.go

@@ -177,3 +177,20 @@ func TestRootDockerInstallerIsCloneAndRunEntryPoint(t *testing.T) {
 		t.Fatal("root installer must not require an operator supplied DOBOTAI_IMAGE")
 	}
 }
+
+func TestRootDockerInstallerBuildsWithInternalGoModuleProxy(t *testing.T) {
+	installer, err := os.ReadFile("../install-docker.sh")
+	if err != nil {
+		t.Fatal(err)
+	}
+	dockerfile, err := os.ReadFile("../Dockerfile")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(installer), "GOPROXY=https://goproxy.cn,direct") {
+		t.Fatal("root installer must pass an internal default GOPROXY to docker build")
+	}
+	if !strings.Contains(string(dockerfile), "ARG GOPROXY") || !strings.Contains(string(dockerfile), "GOPROXY=$GOPROXY go mod download") {
+		t.Fatal("Dockerfile must accept and use the root installer GOPROXY")
+	}
+}