fix: don't rm root-owned COPY temp files as non-root build user

[johnyaku]

Problem

The Deploy-to-NCI run for #61 (merged) failed building absconda's own image:

185.9 No broken requirements found.        ← pip check passed
185.9 rm: cannot remove '/tmp/requirements.txt': Operation not permitted
ERROR: failed to build: ... exit code: 1

The conda+pip two-phase install itself worked. The failure was the cleanup step I added to the packed paths: the build runs as the non-root $MAMBA_USER, but COPY <<'ABSCONDA_PIP' /tmp/requirements.txt creates the file owned by root. In sticky /tmp, a non-owner can't delete it, so rm -f /tmp/requirements.txt failed and broke the && chain.

(The conda_on_base path runs as root, so its rm is fine — and that path isn't what CI builds.)

Fix

Drop the rm -f /tmp/requirements.txt /tmp/conda.constraints.txt line in builder_stage.j2 and single_stage.j2:

• builder_stage (multi-stage): the builder stage is discarded, so /tmp leftovers never reach the runtime image.
• single_stage: already left /tmp/env.yaml behind pre-feat: install pip deps constrained to conda's resolved versions #61, so this is consistent; the leftover is a harmless few-KB text file.

conda_on_base.j2 keeps its cleanup (runs as root, permitted).

Testing

• pytest tests/test_templates.py: 9 passed; full suite green. ruff clean.
• Re-rendered the multi-stage-with-pip Dockerfile and confirmed the && chain is intact (… pip check && conda-pack && …) with no rm of the COPY'd file.

Follow-up to #61. Merging this re-triggers Deploy-to-NCI, which should now build cleanly.

🤖 Generated with Claude Code