Add fallback: scripts/save_droplet_image.sh

Insurance for the case where the public-base Dockerfile diverges
from the bootstrap droplet's ABI in a way that breaks specialists.
Commits the running container as an image, saves to a compressed
tarball (zstd if available, gzip fallback), and scp's it
off-droplet to a backup dir.

Not run by default — tarball is ~15 GB compressed and the scp takes
the better part of an hour. Use only if the Dockerfile build can't
reproduce the working env (e.g. AMD changes the public ROCm release
in a way that drops MI300X kernels we depend on). For 99% of
redeploys, scripts/deploy_droplet.sh + the Dockerfile are the right
path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/save_droplet_image.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+# Riprap droplet image fallback — save the bootstrap droplet's
+# riprap-models image to a portable tarball.
+#
+# Use this when the public-base Dockerfile (services/riprap-models/Dockerfile)
+# can't be reproduced — e.g. when AMD's public ROCm release diverges from
+# the bootstrap droplet's ABI in a way that breaks our specialists. The
+# saved tarball is byte-identical to the running container's image, so
+# `docker load` on a fresh droplet gives you the exact env that worked.
+#
+# Caveats:
+# - Tarballs are huge (~15 GB compressed, ~35 GB raw)
+# - Needs the droplet to still be alive (run BEFORE you destroy it)
+# - Can't be uploaded to a public registry without redacting any
+#   embedded auth tokens; recommend you scp it to backup storage
+#
+# Usage:
+#   scripts/save_droplet_image.sh <droplet-ip> [out-dir]
+#
+# Default out-dir: ~/riprap-backups/
+set -euo pipefail
+
+if [ "$#" -lt 1 ]; then
+    echo "Usage: $0 <droplet-ip> [out-dir]" >&2
+    exit 64
+fi
+
+DROPLET_IP="$1"
+OUT_DIR="${2:-$HOME/riprap-backups}"
+SSH_USER="${SSH_USER:-root}"
+SSH_KEY_FLAG=""
+if [ -n "${SSH_KEY:-}" ]; then SSH_KEY_FLAG="-i $SSH_KEY"; fi
+SSH="ssh $SSH_KEY_FLAG -o StrictHostKeyChecking=accept-new ${SSH_USER}@${DROPLET_IP}"
+SCP="scp $SSH_KEY_FLAG -o StrictHostKeyChecking=accept-new"
+
+mkdir -p "$OUT_DIR"
+STAMP=$(date -u +%Y%m%d-%H%M%S)
+TAR="$OUT_DIR/riprap-droplet-base-${STAMP}.tar"
+
+echo "==> 1. Commit running terramind container as image"
+$SSH 'docker commit terramind riprap-droplet-base:latest'
+
+echo "==> 2. Save image to droplet-local tarball"
+$SSH "docker save riprap-droplet-base:latest -o /workspace/riprap-droplet-base.tar"
+SIZE=$($SSH 'stat -c %s /workspace/riprap-droplet-base.tar')
+echo "    droplet-local tarball: $SIZE bytes"
+
+echo "==> 3. Compress (zstd preferred; gzip fallback)"
+if $SSH 'command -v zstd > /dev/null'; then
+    $SSH 'zstd -3 --rm /workspace/riprap-droplet-base.tar'
+    REMOTE="/workspace/riprap-droplet-base.tar.zst"
+else
+    $SSH 'gzip /workspace/riprap-droplet-base.tar'
+    REMOTE="/workspace/riprap-droplet-base.tar.gz"
+fi
+CSIZE=$($SSH "stat -c %s $REMOTE")
+echo "    compressed: $CSIZE bytes ($(awk "BEGIN { printf \"%.1f\", $CSIZE/$SIZE*100 }")% of raw)"
+
+echo "==> 4. scp to local: $TAR$(basename $REMOTE | sed 's|riprap-droplet-base.tar||')"
+$SCP "${SSH_USER}@${DROPLET_IP}:${REMOTE}" "${TAR}$(echo $REMOTE | sed 's|.*\.tar||')"
+
+echo "==> 5. Cleanup droplet tarball"
+$SSH "rm -f $REMOTE"
+
+ls -lh "${TAR}"*
+echo
+echo "Restore on a fresh droplet:"
+echo "  scp ${TAR}* root@<new-ip>:/workspace/"
+echo "  ssh root@<new-ip> 'zstd -d /workspace/riprap-droplet-base.tar.zst -o /tmp/img.tar && docker load -i /tmp/img.tar'"
+echo "  Then docker run with the original device flags (see CLAUDE.md)."