ci: switch app Dockerfile to FROM prop-base

The wgrib2-builder stage and the runtime apt-install stages
(libstdc++6/openssl/locale + cdo/gdal-bin) now live in
git.mcintire.me/graham/prop-base, built separately by build-base.yaml.
The app Dockerfile FROMs that image and just COPYs the Elixir release
on top.

Net effect: typical pushes drop ~8 min of wgrib2 compile + ~2 min of
cdo/gdal-bin apt installs. Bumping wgrib2 or g2c is now a one-line
change to Dockerfile.base — the next push picks up :latest
automatically.

Dockerfile

@@ -8,8 +8,7 @@
 # This file is based on these images:
 #
 #   - https://hub.docker.com/r/hexpm/elixir/tags - for the build image
-#   - https://hub.docker.com/_/debian/tags?name=trixie-20260316-slim - for the release image
-#   - https://pkgs.org/ - resource for finding needed packages
+#   - git.mcintire.me/graham/prop-base - prebuilt runtime base (see Dockerfile.base)
 #   - Ex: docker.io/hexpm/elixir:1.19.5-erlang-28.4.1-debian-trixie-20260316-slim
 #
 ARG ELIXIR_VERSION=1.19.5
@@ -17,82 +16,12 @@ ARG OTP_VERSION=28.4.1
 ARG DEBIAN_VERSION=trixie-20260316-slim
 
 ARG BUILDER_IMAGE="docker.io/hexpm/elixir:${ELIXIR_VERSION}-erlang-${OTP_VERSION}-debian-${DEBIAN_VERSION}"
-ARG RUNNER_IMAGE="docker.io/debian:${DEBIAN_VERSION}"
-
-# ---- wgrib2 build stage (cached independently) ----
-FROM ${RUNNER_IMAGE} AS wgrib2-builder
-
-ARG WGRIB2_VERSION=3.8.0
-# wgrib2 3.6.0 has a memory-corruption bug that surfaces on HRDPS
-# rotated lat/lon files via -lon point extraction: emits denormal
-# garbage values, then aborts with `free(): invalid size`. 3.8.0
-# fixes it. Verified by reproducing the failure with wgrib2 3.6.0
-# in the production pod against an HRDPS file on 2026-04-30 and
-# confirming 3.8.0 handles the same file correctly locally. Keep
-# this aligned with rust/prop_grid_rs/Dockerfile.
-# g2c v2.1.0 is the first release where BUILD_G2C defaults ON, which
-# wgrib2 needs at link time (g2c_enc_jpeg2000 / g2c_dec_jpeg2000
-# come from the "new" file-based API). wgrib2 3.8.0 bumps the
-# find_package requirement to g2c >= 2.3.0 (CMakeLists.txt:93).
-ARG G2C_VERSION=2.3.0
-
-# BuildKit cache mounts keep the .deb archive + apt-lists out of the
-# image overlay and on the builder's cache storage, so image layers
-# don't pay the disk cost and CI runners with tight /var budgets can
-# still fetch ~100 MB of packages. The `rm -rf lists/*` below targets
-# the cache-mount contents; BuildKit persists whatever remains for
-# the next build.
-RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
-    --mount=type=cache,target=/var/lib/apt,sharing=locked \
-    rm -f /etc/apt/apt.conf.d/docker-clean \
-    && apt-get update \
-    && apt-get install -y --no-install-recommends \
-       build-essential gfortran cmake wget ca-certificates pkg-config \
-       zlib1g-dev libaec-dev libpng-dev libopenjp2-7-dev
-
-# NCEPLIBS-g2c: wgrib2 >= 3.x delegates GRIB2 decompression to this
-# library via find_package whenever any of JASPER / OPENJPEG / PNG
-# is enabled (wgrib2 CMakeLists:94). Build g2c with all the
-# decoders we care about — PNG (MRMS PrecipRate / HRRR native),
-# OpenJPEG (modern JPEG2000 replacement for the CVE-riddled Jasper),
-# and AEC (CCSDS) — and disable Jasper so we don't need libjasper,
-# which Debian dropped years ago.
-WORKDIR /tmp/g2c
-RUN wget -q --content-disposition "https://github.com/NOAA-EMC/NCEPLIBS-g2c/archive/refs/tags/v${G2C_VERSION}.tar.gz" \
-      -O g2c.tar.gz \
-  && tar xzf g2c.tar.gz \
-  && cd NCEPLIBS-g2c-${G2C_VERSION} \
-  && mkdir build && cd build \
-  && cmake .. -DCMAKE_INSTALL_PREFIX=/usr/local \
-              -DCMAKE_BUILD_TYPE=Release \
-              -DUSE_PNG=ON \
-              -DUSE_AEC=ON \
-              -DUSE_OpenJPEG=ON \
-              -DUSE_Jasper=OFF \
-  && make -j$(nproc) \
-  && make install
-
-WORKDIR /tmp/wgrib2
-
-# wgrib2 3.8.0 cmake flags:
-#   * USE_AEC turns on AEC compression decode for HRRR files.
-#   * USE_G2CLIB_LOW links wgrib2 to the external g2c lib for png +
-#     jpeg2000 decode. The previous USE_PNG / USE_OPENJPEG flags don't
-#     exist in wgrib2 3.8.0 — they were silently ignored, leaving
-#     wgrib2 unable to read GRIB2 packing type 40 (HRDPS uses it).
-#     Verified 2026-04-30 by ldd showing only libc/libm linked.
-#   * The g2c v2.3.0 build above carries the actual OpenJPEG support;
-#     wgrib2 dispatches to g2c via USE_G2CLIB_LOW.
-RUN wget -q --content-disposition "https://github.com/NOAA-EMC/wgrib2/archive/refs/tags/v${WGRIB2_VERSION}.tar.gz" \
-      -O wgrib2.tar.gz \
-  && tar xzf wgrib2.tar.gz \
-  && cd wgrib2-${WGRIB2_VERSION} \
-  && mkdir build && cd build \
-  && cmake .. -DCMAKE_INSTALL_PREFIX=/usr/local -DCMAKE_BUILD_TYPE=Release \
-       -DUSE_AEC=ON -DUSE_G2CLIB_LOW=ON \
-  && make -j$(nproc) \
-  && make install \
-  && strip /usr/local/bin/wgrib2
+# Prebuilt runtime base contains wgrib2 + cdo + gdal-bin + locale + the
+# BEAM runtime apt deps. Built by .forgejo/workflows/build-base.yaml
+# only when Dockerfile.base changes, so this Dockerfile pulls a
+# ready-made layer instead of recompiling wgrib2 + reinstalling cdo
+# (~10 min) on every push.
+ARG BASE_IMAGE="git.mcintire.me/graham/prop-base:latest"
 
 # ---- Elixir build stage ----
 FROM ${BUILDER_IMAGE} AS builder
@@ -154,50 +83,21 @@ COPY rel rel
 RUN mix release
 
 # ---- Final runtime stage ----
-FROM ${RUNNER_IMAGE} AS final
+# Pulls the prebuilt prop-base image (Dockerfile.base) which already
+# carries wgrib2 + g2c libs + cdo + gdal-bin + locale + BEAM runtime
+# apt deps. We just COPY the Elixir release on top.
+FROM ${BASE_IMAGE} AS final
 
 # Build timestamp baked in by CI (--build-arg BUILD_TIMESTAMP=...).
 # Only consumed in this final stage, so it never busts the earlier
 # compile cache. Read at runtime by Microwaveprop.Application.build_timestamp/0.
 ARG BUILD_TIMESTAMP=unknown
 
-# Runtime deps. BuildKit cache mounts keep the .deb archives and apt
-# lists out of the image layer, so the CI builder's tight /var disk
-# cap doesn't trip during install. cdo is split into its own RUN
-# layer because its dep tree (netCDF/HDF5/ecCodes/Fortran) is ~1 GB
-# and we'd rather not have a single failed cdo install invalidate the
-# base-runtime layer.
-RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
-    --mount=type=cache,target=/var/lib/apt,sharing=locked \
-    rm -f /etc/apt/apt.conf.d/docker-clean \
-    && apt-get update \
-    && apt-get install -y --no-install-recommends \
-       libstdc++6 openssl libncurses6 locales ca-certificates snmp \
-       libgfortran5 libaec0 zlib1g libpng16-16t64 libopenjp2-7
-
-RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
-    --mount=type=cache,target=/var/lib/apt,sharing=locked \
-    rm -f /etc/apt/apt.conf.d/docker-clean \
-    && apt-get update \
-    && apt-get install -y --no-install-recommends cdo gdal-bin
-
-RUN sed -i '/en_US.UTF-8/s/^# //g' /etc/locale.gen && locale-gen
-
-ENV LANG=en_US.UTF-8
-ENV LANGUAGE=en_US:en
-ENV LC_ALL=en_US.UTF-8
 ENV MIX_ENV="prod"
 
 WORKDIR "/app"
 RUN chown nobody /app
 
-COPY --from=wgrib2-builder /usr/local/bin/wgrib2 /usr/local/bin/wgrib2
-# wgrib2 links dynamically against libg2c.so from the builder stage —
-# carry it across and refresh the loader cache so /usr/local/lib is
-# searched at exec time.
-COPY --from=wgrib2-builder /usr/local/lib/libg2c.so* /usr/local/lib/
-RUN ldconfig
-
 COPY --from=builder --chown=nobody:root /app/_build/${MIX_ENV}/rel/microwaveprop ./
 
 RUN echo "${BUILD_TIMESTAMP}" > /app/BUILD_TIMESTAMP \