fix(ci): write requirements.txt in Python; bust DinD COPY cache

DinD legacy builder left requirements.txt empty when using shell redirect
on a cached COPY pyproject.toml layer. Write deps from Python directly,
add .ci-build-id COPY in CI, and preflight grep asyncpg in buildctx.

.forgejo/workflows/image.yaml

@@ -53,7 +53,10 @@ jobs:
           # Runner DinD has legacy docker (no buildx); vendor hub-core into context.
           mkdir -p buildctx/_hub_core_src
           cp -r /tmp/ctx-hub_core_src/pyproject.toml /tmp/ctx-hub_core_src/hub_core buildctx/_hub_core_src/
+          echo "${SHORT}" > buildctx/.ci-build-id
+          grep -q 'asyncpg' buildctx/pyproject.toml
           sed \
+            -e 's|^COPY pyproject.toml|COPY .ci-build-id /tmp/.ci-build-id\nCOPY pyproject.toml|' \
             -e 's|COPY --from=hub_core_src pyproject.toml|COPY _hub_core_src/pyproject.toml|' \
             -e 's|COPY --from=hub_core_src hub_core/|COPY _hub_core_src/hub_core/|' \
             buildctx/Dockerfile > buildctx/Dockerfile.ci
@@ -62,7 +65,7 @@ jobs:
           export PATH="${HOME}/bin:${PATH}"
           echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
           IMAGE="${REGISTRY}/${IMAGE_NAME}"
-          docker build --build-arg DEPS_LOCK_ID=2 -f buildctx/Dockerfile.ci \
+          docker build --build-arg DEPS_LOCK_ID=3 -f buildctx/Dockerfile.ci \
             -t "${IMAGE}:latest" -t "${IMAGE}:main-${SHORT}" buildctx
           docker push "${IMAGE}:latest"
           docker push "${IMAGE}:main-${SHORT}"

Dockerfile

@@ -14,10 +14,11 @@ RUN apt-get update \
 COPY pyproject.toml ./
 
 # Bump DEPS_LOCK_ID when dependency wiring changes (busts DinD layer cache).
-ARG DEPS_LOCK_ID=2
-RUN echo "deps-lock=${DEPS_LOCK_ID}" && python - <<'PY' > /tmp/requirements.txt
+ARG DEPS_LOCK_ID=3
+RUN echo "deps-lock=${DEPS_LOCK_ID}" && python - <<'PY'
 import sys
 import tomllib
+from pathlib import Path
 
 with open("pyproject.toml", "rb") as f:
     project = tomllib.load(f)["project"]
@@ -26,15 +27,20 @@ deps = project.get("dependencies") or []
 if not deps:
     sys.exit("pyproject.toml has no dependencies")
 
-for dep in deps:
-    # llm-connect is a local editable test integration and must not be pulled
-    # into the production image. hub-core is runtime code, but it is installed
-    # from the named Docker build context below because it is not published yet.
-    if dep in {"llm-connect", "hub-core"}:
-        continue
-    print(dep)
+skip = {"llm-connect", "hub-core"}
+lines = [
+    dep
+    for dep in deps
+    if dep not in skip
+]
+if not lines:
+    sys.exit("no installable dependencies after filter")
+
+Path("/tmp/requirements.txt").write_text("\n".join(lines) + "\n", encoding="utf-8")
+if Path("/tmp/requirements.txt").stat().st_size == 0:
+    sys.exit("requirements.txt is empty")
+print(f"wrote {len(lines)} requirements")
 PY
-RUN test -s /tmp/requirements.txt
 
 RUN uv venv /app/.venv \
     && uv pip install --python /app/.venv/bin/python --no-cache -r /tmp/requirements.txt