fix(ci): write requirements.txt in Python; bust DinD COPY cache

DinD legacy builder left requirements.txt empty when using shell redirect
on a cached COPY pyproject.toml layer. Write deps from Python directly,
add .ci-build-id COPY in CI, and preflight grep asyncpg in buildctx.

.forgejo/workflows/image.yaml

@@ -53,7 +53,10 @@ jobs:
           # Runner DinD has legacy docker (no buildx); vendor hub-core into context.
           mkdir -p buildctx/_hub_core_src
           cp -r /tmp/ctx-hub_core_src/pyproject.toml /tmp/ctx-hub_core_src/hub_core buildctx/_hub_core_src/
+          echo "${SHORT}" > buildctx/.ci-build-id
+          grep -q 'asyncpg' buildctx/pyproject.toml
           sed \
+            -e 's|^COPY pyproject.toml|COPY .ci-build-id /tmp/.ci-build-id\nCOPY pyproject.toml|' \
             -e 's|COPY --from=hub_core_src pyproject.toml|COPY _hub_core_src/pyproject.toml|' \
             -e 's|COPY --from=hub_core_src hub_core/|COPY _hub_core_src/hub_core/|' \
             buildctx/Dockerfile > buildctx/Dockerfile.ci
@@ -62,7 +65,7 @@ jobs:
           export PATH="${HOME}/bin:${PATH}"
           echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
           IMAGE="${REGISTRY}/${IMAGE_NAME}"
-          docker build --build-arg DEPS_LOCK_ID=2 -f buildctx/Dockerfile.ci \
+          docker build --build-arg DEPS_LOCK_ID=3 -f buildctx/Dockerfile.ci \
             -t "${IMAGE}:latest" -t "${IMAGE}:main-${SHORT}" buildctx
           docker push "${IMAGE}:latest"
           docker push "${IMAGE}:main-${SHORT}"