fix(ci): bust DinD deps cache without full --no-cache rebuild

Full --no-cache exceeded runner time budget. Use DEPS_LOCK_ID build-arg
and fail-fast checks on requirements.txt instead.

Dockerfile

@@ -13,13 +13,20 @@ RUN apt-get update \
 
 COPY pyproject.toml ./
 
+# Bump DEPS_LOCK_ID when dependency wiring changes (busts DinD layer cache).
+ARG DEPS_LOCK_ID=2
 RUN python - <<'PY' > /tmp/requirements.txt
+import sys
 import tomllib
 
 with open("pyproject.toml", "rb") as f:
     project = tomllib.load(f)["project"]
 
-for dep in project["dependencies"]:
+deps = project.get("dependencies") or []
+if not deps:
+    sys.exit("pyproject.toml has no dependencies")
+
+for dep in deps:
     # llm-connect is a local editable test integration and must not be pulled
     # into the production image. hub-core is runtime code, but it is installed
     # from the named Docker build context below because it is not published yet.
@@ -27,6 +34,7 @@ for dep in project["dependencies"]:
         continue
     print(dep)
 PY
+RUN test -s /tmp/requirements.txt
 
 RUN uv venv /app/.venv \
     && uv pip install --python /app/.venv/bin/python --no-cache -r /tmp/requirements.txt