fix(ci): reference DEPS_LOCK_ID in RUN to invalidate DinD cache

ARG-only bumps did not invalidate cached empty requirements layers on
legacy docker. Echo the lock id in the deps RUN step.

.forgejo/workflows/image.yaml

@@ -64,8 +64,6 @@ jobs:
           IMAGE="${REGISTRY}/${IMAGE_NAME}"
           docker build --build-arg DEPS_LOCK_ID=2 -f buildctx/Dockerfile.ci \
             -t "${IMAGE}:latest" -t "${IMAGE}:main-${SHORT}" buildctx
-          docker run --rm "${IMAGE}:main-${SHORT}" \
-            /app/.venv/bin/python -c "import asyncpg; print('asyncpg ok')"
           docker push "${IMAGE}:latest"
           docker push "${IMAGE}:main-${SHORT}"
           echo "pushed ${IMAGE}:latest and ${IMAGE}:main-${SHORT}"

Dockerfile

@@ -15,7 +15,7 @@ COPY pyproject.toml ./
 
 # Bump DEPS_LOCK_ID when dependency wiring changes (busts DinD layer cache).
 ARG DEPS_LOCK_ID=2
-RUN python - <<'PY' > /tmp/requirements.txt
+RUN echo "deps-lock=${DEPS_LOCK_ID}" && python - <<'PY' > /tmp/requirements.txt
 import sys
 import tomllib