V3 deterministic Dockerfile lint capability pack. By-value connector composition (service_kind=cli, no separate ingredient): one local hadolint CLI ingredient exposes bounded project operations for readiness and Dockerfile lint diagnostics. Lints run from an explicit project directory cwd supplied at execution time, check one trusted local Dockerfile path, and return JSON diagnostics via the dockerfile.lint catalog operation. Fixed-function and reproducible: no arbitrary hadolint flags, no caller-supplied config path, no ignore-rule hole, no trusted-registry override, no shell wrapper, no Docker image execution, and no network egress. Lint findings are represented as JSON output instead of failing the op; real invocation errors still fail. Requires hadolint on PATH. Local and no-egress.