chore(docker): lean images — drop unused playwright, dedupe grok layer, cache-stable /app layering

- agent-dev-fe / agent-qa-fe: remove playwright chromium + its system libs (~770MB each; verified unused — panel tests are vitest, e2e harness is scripted Python; pnpm kept)
- agent-grok: drop the redundant chown -R that duplicated the 149MB CLI tree into a second layer (install already runs as agent)
- agent-base + orchestrator runners: split the single /app COPY into .venv-first / source-last layers so a source-only deploy re-layers ~13MB instead of ~380MB per image
- agent-base: split the 813MB apt+node+claude-code RUN so a CLI bump no longer re-downloads the OS/node layer
- .dockerignore: exclude gitignored docs/internal from the orchestrator's docs COPY; pin uv helper image to 0.11
- verified: all four images rebuilt + runtime-probed (claude/git/jq/node/uv/pnpm/grok, import roboco, docs/alembic/agents present); .venv layer proven CACHED across a source-only change

.dockerignore

@@ -46,6 +46,11 @@ data/
 logs/
 *.log
 
+# Gitignored working notes — leak into the orchestrator's COPY docs layer from
+# a CEO working tree that has them checked out locally, causing env-dependent
+# cache keys (docs/rag/ + docs/map/ are NOT ignored — the agent-facing corpus).
+docs/internal/
+
 # VCS and editor cruft
 .idea
 .vscode