fix(ci): write requirements.txt in Python; bust DinD COPY cache

DinD legacy builder left requirements.txt empty when using shell redirect
on a cached COPY pyproject.toml layer. Write deps from Python directly,
add .ci-build-id COPY in CI, and preflight grep asyncpg in buildctx.

Dockerfile

@@ -14,10 +14,11 @@ RUN apt-get update \
 COPY pyproject.toml ./
 
 # Bump DEPS_LOCK_ID when dependency wiring changes (busts DinD layer cache).
-ARG DEPS_LOCK_ID=2
-RUN echo "deps-lock=${DEPS_LOCK_ID}" && python - <<'PY' > /tmp/requirements.txt
+ARG DEPS_LOCK_ID=3
+RUN echo "deps-lock=${DEPS_LOCK_ID}" && python - <<'PY'
 import sys
 import tomllib
+from pathlib import Path
 
 with open("pyproject.toml", "rb") as f:
     project = tomllib.load(f)["project"]
@@ -26,15 +27,20 @@ deps = project.get("dependencies") or []
 if not deps:
     sys.exit("pyproject.toml has no dependencies")
 
-for dep in deps:
-    # llm-connect is a local editable test integration and must not be pulled
-    # into the production image. hub-core is runtime code, but it is installed
-    # from the named Docker build context below because it is not published yet.
-    if dep in {"llm-connect", "hub-core"}:
-        continue
-    print(dep)
+skip = {"llm-connect", "hub-core"}
+lines = [
+    dep
+    for dep in deps
+    if dep not in skip
+]
+if not lines:
+    sys.exit("no installable dependencies after filter")
+
+Path("/tmp/requirements.txt").write_text("\n".join(lines) + "\n", encoding="utf-8")
+if Path("/tmp/requirements.txt").stat().st_size == 0:
+    sys.exit("requirements.txt is empty")
+print(f"wrote {len(lines)} requirements")
 PY
-RUN test -s /tmp/requirements.txt
 
 RUN uv venv /app/.venv \
     && uv pip install --python /app/.venv/bin/python --no-cache -r /tmp/requirements.txt