build: fix goose binary copy path for cross-compile

go install with GOOS/GOARCH set drops binaries in /go/bin/<goos>_<goarch>/,
which broke the COPY in go-base. Switching to git clone + go build with
explicit -o /app/goose so the output path is stable regardless of host
platform.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -51,9 +51,16 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} go build -ldflags="-w -s" -o /
 
 # Install goose CLI for production migrations. Pinned to a specific version
 # so an upstream behavioural change can't break a deploy unannounced.
-# Bumping is a deliberate, reviewable diff.
-RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} \
-    go install github.com/pressly/goose/v3/cmd/goose@v3.22.1
+# Bumping is a deliberate, reviewable diff. We `go build` rather than
+# `go install` so the output path is predictable across host platforms —
+# `go install` with cross-compile env vars drops the binary in
+# /go/bin/<goos>_<goarch>/, which is awkward to COPY from.
+RUN cd /tmp && \
+    git clone --depth=1 --branch=v3.22.1 https://github.com/pressly/goose.git goose-src && \
+    cd goose-src && \
+    CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} \
+      go build -ldflags="-w -s" -o /app/goose ./cmd/goose && \
+    cd / && rm -rf /tmp/goose-src
 
 # Base runtime stage for Go services
 FROM alpine:3.19 AS go-base
@@ -72,7 +79,7 @@ COPY --from=builder /app/api /app/api
 COPY --from=builder /app/worker /app/worker
 # goose is the migration runner — same image is reused as the migrate Job
 # entrypoint via `command: ["/usr/local/bin/goose", ...]`.
-COPY --from=builder /go/bin/goose /usr/local/bin/goose
+COPY --from=builder /app/goose /usr/local/bin/goose
 
 # Copy templates directory
 COPY --from=builder /app/templates /app/templates