based on @Finagolfin ’s explanation, i believe that the first dockerfile provides the environment that the swift CI loads before running utils/build-script, and this is the dockerfile that needs to have ld.gold. i built a toolchain overnight using this dockerfile as a base layer, so i know it works in at least one environment.
the version-specific dockerfiles install tar ephemerally before extracting the package and the “slim” images remove it immediately afterwards.
i originally anticipated that we would need to ship ld.gold with the version-specific dockerfiles as well, but as i mentioned earlier, ld.gold isn’t usable in the images anyways, so toolchain users need to specify use-ld=ld to compile anything in release mode.