fix(ci): install protoc and pick a CUDA arch that builds without a GPU

prover/Dockerfile

@@ -23,6 +23,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         libssl-dev \
         pkg-config \
         clang \
+        protobuf-compiler \
     && rm -rf /var/lib/apt/lists/*
 
 # Rustup with no default toolchain; the repo's rust-toolchain.toml decides.
@@ -40,21 +41,50 @@ RUN rustc --version && cargo --version
 
 # risc0 toolchain for guest-program build scripts in libveritas. Pin via
 # RISC0_VERSION for reproducible builds; empty means "latest".
+#
+# risc0-groth16 is installed explicitly: `subs-prover compress` runs
+# ProverOpts::groth16(), so without that component the binary builds fine and
+# then fails at runtime on the pod. Bare `rzup install` happens to include it,
+# but the pinned branch below would not.
 ARG RISC0_VERSION=
 RUN curl -L https://risczero.com/install | bash \
     && if [ -n "${RISC0_VERSION}" ]; then \
            rzup install rust "${RISC0_VERSION}" && rzup install cpp; \
        else \
            rzup install; \
-       fi
+       fi \
+    && rzup install risc0-groth16
+
+# Target GPU architectures for the risc0 CUDA kernels.
+#
+# risc0's build scripts hardcode `-arch=native`, which asks nvcc to detect the
+# local GPU. Build machines have none, so nvcc falls back to a default below
+# sm_60 and the compile dies on "CUDA atomics are only supported for sm_60 and
+# up". Those scripts skip `-arch=native` when NVCC_PREPEND_FLAGS is set, so
+# setting it is both how the arch gets chosen and how the broken default is
+# avoided.
+#
+# The default builds SASS for sm_80 (A100) plus compute_80 PTX, which the
+# driver JITs onto anything newer — RTX 4090 / L40S (sm_89) and H100 / H200
+# (sm_90) all run from it. That keeps this to one SASS target: each additional
+# one recompiles every kernel, and these kernels dominate the build.
+#
+# The cost is a one-off JIT pause the first time a non-A100 pod starts. Add an
+# explicit gencode for a card you run constantly to skip it, e.g.
+#   --build-arg CUDA_ARCHS="-gencode arch=compute_90,code=sm_90 -gencode arch=compute_80,code=compute_80"
+ARG CUDA_ARCHS="-gencode arch=compute_80,code=sm_80 -gencode arch=compute_80,code=compute_80"
+ENV NVCC_PREPEND_FLAGS="${CUDA_ARCHS}"
 
 # Cargo needs every workspace member present to resolve the manifest, even
 # though subs-prover only depends on types/. git stays installed above because
 # the workspace pulls certrelay and spaces_testutil as git dependencies.
 # See .dockerignore for exclusions.
 COPY . .
 
-RUN cargo build --release -p subs-prover --features cuda --bin subs-prover
+# --locked so the committed Cargo.lock is enforced rather than merely
+# preferred; without it the image can silently resolve different versions than
+# the commit it claims to be built from.
+RUN cargo build --locked --release -p subs-prover --features cuda --bin subs-prover
 
 # ----- Runtime stage -----------------------------------------------------
 FROM nvidia/cuda:12.4.0-runtime-ubuntu22.04