COPY restored the repo's lock over the one the first install wrote for HEAD's source-built gems, so bundle exec resolved against precompiled variants the image never carried.

Assisted-by: GLM-5.3 via pi

diff --git a/Dockerfile b/Dockerfile
index 9f2ff98..355980d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -22,6 +22,15 @@ RUN bundle config set without development && bundle install
 
 COPY . .
 
+# On HEAD the install above compiled the native gems from source and
+# rewrote the lock to what it installed; COPY then restored the
+# repository's lock, pinning precompiled variants the image does not
+# carry, and `bundle exec` in the container (the console task execs
+# one) resolves against the lock. Install again off the restored lock
+# so it agrees with the installed set; on a released Ruby this is a
+# verifying no-op.
+RUN bundle install
+
 FROM ${RUBY_IMAGE}
 
 ENV GEM_HOME=/usr/local/bundle BUNDLE_APP_CONFIG=/usr/local/bundle BUNDLE_SILENCE_ROOT_WARNING=1