fix(ci): bust DinD deps cache without full --no-cache rebuild

Full --no-cache exceeded runner time budget. Use DEPS_LOCK_ID build-arg
and fail-fast checks on requirements.txt instead.

.forgejo/workflows/image.yaml

@@ -62,7 +62,7 @@ jobs:
           export PATH="${HOME}/bin:${PATH}"
           echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
           IMAGE="${REGISTRY}/${IMAGE_NAME}"
-          docker build --no-cache -f buildctx/Dockerfile.ci \
+          docker build --build-arg DEPS_LOCK_ID=2 -f buildctx/Dockerfile.ci \
             -t "${IMAGE}:latest" -t "${IMAGE}:main-${SHORT}" buildctx
           docker run --rm "${IMAGE}:main-${SHORT}" \
             /app/.venv/bin/python -c "import asyncpg; print('asyncpg ok')"

Dockerfile

@@ -13,13 +13,20 @@ RUN apt-get update \
 
 COPY pyproject.toml ./
 
+# Bump DEPS_LOCK_ID when dependency wiring changes (busts DinD layer cache).
+ARG DEPS_LOCK_ID=2
 RUN python - <<'PY' > /tmp/requirements.txt
+import sys
 import tomllib
 
 with open("pyproject.toml", "rb") as f:
     project = tomllib.load(f)["project"]
 
-for dep in project["dependencies"]:
+deps = project.get("dependencies") or []
+if not deps:
+    sys.exit("pyproject.toml has no dependencies")
+
+for dep in deps:
     # llm-connect is a local editable test integration and must not be pulled
     # into the production image. hub-core is runtime code, but it is installed
     # from the named Docker build context below because it is not published yet.
@@ -27,6 +34,7 @@ for dep in project["dependencies"]:
         continue
     print(dep)
 PY
+RUN test -s /tmp/requirements.txt
 
 RUN uv venv /app/.venv \
     && uv pip install --python /app/.venv/bin/python --no-cache -r /tmp/requirements.txt