fix(ci): store requirements.txt under /app not /tmp

DinD legacy builder does not persist /tmp across RUN steps, so uv pip
install could not find requirements.txt on the next layer.

Dockerfile

@@ -14,7 +14,7 @@ RUN apt-get update \
 COPY pyproject.toml ./
 
 # Bump DEPS_LOCK_ID when dependency wiring changes (busts DinD layer cache).
-ARG DEPS_LOCK_ID=3
+ARG DEPS_LOCK_ID=4
 RUN echo "deps-lock=${DEPS_LOCK_ID}" && python - <<'PY'
 import sys
 import tomllib
@@ -36,21 +36,22 @@ lines = [
 if not lines:
     sys.exit("no installable dependencies after filter")
 
-Path("/tmp/requirements.txt").write_text("\n".join(lines) + "\n", encoding="utf-8")
-if Path("/tmp/requirements.txt").stat().st_size == 0:
+req_path = Path("/app/requirements.txt")
+req_path.write_text("\n".join(lines) + "\n", encoding="utf-8")
+if req_path.stat().st_size == 0:
     sys.exit("requirements.txt is empty")
-print(f"wrote {len(lines)} requirements")
+print(f"wrote {len(lines)} requirements to {req_path}")
 PY
 
 RUN uv venv /app/.venv \
-    && uv pip install --python /app/.venv/bin/python --no-cache -r /tmp/requirements.txt
+    && uv pip install --python /app/.venv/bin/python --no-cache -r /app/requirements.txt
 
 COPY --from=hub_core_src pyproject.toml /tmp/hub-core/pyproject.toml
 COPY --from=hub_core_src hub_core/ /tmp/hub-core/hub_core/
 
 RUN uv pip install --python /app/.venv/bin/python --no-cache /tmp/hub-core
 
-RUN test -s /tmp/requirements.txt \
+RUN test -s /app/requirements.txt \
     && /app/.venv/bin/python -c "import asyncpg"
 
 COPY alembic.ini ./