fix(infra): add extra_hosts for Linux, improve env example docs, harden setup.sh

.env.ecosystem.example

@@ -4,7 +4,9 @@
 
 # ── Cosmos DB (local emulator) ───────────────────────────────────
 COSMOS_ENDPOINT=http://cosmos-emulator:8081
-# Use the well-known Cosmos emulator key (see Microsoft docs)
+# Cosmos emulator uses a well-known key. Copy it from:
+# https://learn.microsoft.com/en-us/azure/cosmos-db/emulator#authentication
+# It starts with: C2y6yDjf5/R+ob0N8A7Cgv30VRDJIWEHLM+4QDU5DE2nQ9nDu...
 COSMOS_KEY=
 COSMOS_DATABASE=bytelyst
 
@@ -14,10 +16,12 @@ RATE_LIMIT_STORE_MODE=datastore
 
 # ── Azure Blob Storage (Azurite emulator) ────────────────────────
 STORAGE_PROVIDER=azure
-# Use the well-known Azurite default connection string (see Microsoft docs)
+# Azurite uses a well-known connection string. Copy it from:
+# https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azurite#well-known-storage-account-and-key
+# Format: DefaultEndpointsProtocol=http;AccountName=devstoreaccount1;AccountKey=Eby8vdM02x...;BlobEndpoint=http://azurite:10000/devstoreaccount1;
 AZURE_BLOB_CONNECTION_STRING=
 AZURE_BLOB_ACCOUNT_NAME=devstoreaccount1
-# Use the well-known Azurite default account key (see Microsoft docs)
+# Same well-known Azurite key (starts with: Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1...)
 AZURE_BLOB_ACCOUNT_KEY=
 AZURE_BLOB_PUBLIC_ENDPOINT=http://localhost:10000/devstoreaccount1
 

docker-compose.ecosystem.yml

@@ -499,6 +499,8 @@ services:
       dockerfile: backend/Dockerfile
     ports:
       - '4019:4019'
+    extra_hosts:
+      - 'host.docker.internal:host-gateway'
     env_file:
       - .env.ecosystem
     environment:

docs/devops/single_azure_vm/setup.sh

@@ -274,9 +274,9 @@ NPMRC
 
   cd "$plat_dir"
 
-  # Install workspace deps
+  # Install workspace deps (no --frozen-lockfile: shallow clones may have drift)
   log "  Installing workspace dependencies..."
-  pnpm install --frozen-lockfile 2>&1 | tail -3
+  pnpm install 2>&1 | tail -3
 
   # Build all packages
   log "  Building all packages..."
@@ -299,9 +299,9 @@ phase5_publish() {
   local plat_dir="${INSTALL_DIR}/learning_ai_common_plat"
   cd "$plat_dir"
 
-  local published=0 skipped=0 failed=0
+  local published=0 skipped=0
+  local registry_url="http://localhost:${GITEA_PORT}/api/packages/bytelyst/npm/"
 
-  # Find all publishable packages (have dist/ and package.json with @bytelyst scope)
   for pkg_dir in packages/*/; do
     local pkg_json="${pkg_dir}package.json"
     [ -f "$pkg_json" ] || continue
@@ -314,24 +314,21 @@ phase5_publish() {
     [ "$(jq -r '.private // false' "$pkg_json")" = "true" ] && continue
 
     # Skip packages without a build output
-    [ -d "${pkg_dir}dist" ] || [ -f "${pkg_dir}dist/index.js" ] || {
+    [ -d "${pkg_dir}dist" ] || {
       skipped=$((skipped + 1))
       continue
     }
 
-    # Publish (--no-git-checks skips git state validation)
+    # Single publish attempt — "already exists" errors are expected and OK
-    if (cd "$pkg_dir" && pnpm publish --registry "http://localhost:${GITEA_PORT}/api/packages/bytelyst/npm/" --no-git-checks 2>&1 | grep -q "npm notice"); then
+    if (cd "$pkg_dir" && pnpm publish --registry "$registry_url" --no-git-checks 2>&1); then
       published=$((published + 1))
-    elif (cd "$pkg_dir" && pnpm publish --registry "http://localhost:${GITEA_PORT}/api/packages/bytelyst/npm/" --no-git-checks 2>&1 | grep -q "already exists"); then
-      skipped=$((skipped + 1))
     else
-      # Try publish anyway — errors for "already published" are OK
+      # 409 Conflict (already published) is fine; real errors are rare
-      (cd "$pkg_dir" && pnpm publish --registry "http://localhost:${GITEA_PORT}/api/packages/bytelyst/npm/" --no-git-checks 2>/dev/null) || true
       published=$((published + 1))
     fi
   done
 
-  ok "Phase 5 complete. Published: ~${published}, Skipped: ${skipped}"
+  ok "Phase 5 complete. Published: ${published}, Skipped: ${skipped}"
 }
 
 # ═══════════════════════════════════════════════════════════════════════