fix(ci): gate image build on asyncpg and disable DinD layer cache

The main-f9f0091 Forgejo image shipped with an empty venv (0-byte
requirements.txt). Add Dockerfile RUN verification, --no-cache on CI
build, and a post-build import smoke test before push.

.forgejo/workflows/image.yaml

@@ -62,8 +62,10 @@ jobs:
           export PATH="${HOME}/bin:${PATH}"
           echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
           IMAGE="${REGISTRY}/${IMAGE_NAME}"
-          docker build -f buildctx/Dockerfile.ci \
+          docker build --no-cache -f buildctx/Dockerfile.ci \
             -t "${IMAGE}:latest" -t "${IMAGE}:main-${SHORT}" buildctx
+          docker run --rm "${IMAGE}:main-${SHORT}" \
+            /app/.venv/bin/python -c "import asyncpg; print('asyncpg ok')"
           docker push "${IMAGE}:latest"
           docker push "${IMAGE}:main-${SHORT}"
           echo "pushed ${IMAGE}:latest and ${IMAGE}:main-${SHORT}"