The main-f9f0091 Forgejo image shipped with an empty venv (0-byte
requirements.txt). Add Dockerfile RUN verification, --no-cache on CI
build, and a post-build import smoke test before push.
Pin helm handoff and Makefile defaults to the f2e042a image after build,
push, CNPG migration, and helm upgrade. Cluster is primary again via
state-hub-primary tunnel.