chore(docker): lean images — drop unused playwright, dedupe grok layer, cache-stable /app layering

- agent-dev-fe / agent-qa-fe: remove playwright chromium + its system libs (~770MB each; verified unused — panel tests are vitest, e2e harness is scripted Python; pnpm kept)
- agent-grok: drop the redundant chown -R that duplicated the 149MB CLI tree into a second layer (install already runs as agent)
- agent-base + orchestrator runners: split the single /app COPY into .venv-first / source-last layers so a source-only deploy re-layers ~13MB instead of ~380MB per image
- agent-base: split the 813MB apt+node+claude-code RUN so a CLI bump no longer re-downloads the OS/node layer
- .dockerignore: exclude gitignored docs/internal from the orchestrator's docs COPY; pin uv helper image to 0.11
- verified: all four images rebuilt + runtime-probed (claude/git/jq/node/uv/pnpm/grok, import roboco, docs/alembic/agents present); .venv layer proven CACHED across a source-only change

docker/agent-base.Dockerfile

@@ -14,7 +14,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         git \
     && rm -rf /var/lib/apt/lists/*
 
-COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
+COPY --from=ghcr.io/astral-sh/uv:0.11 /uv /usr/local/bin/uv
 
 WORKDIR /app
 
@@ -45,10 +45,14 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     curl ca-certificates git gnupg jq build-essential \
     && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
     && apt-get install -y --no-install-recommends nodejs \
-    && npm install -g @anthropic-ai/claude-code \
-    && npm cache clean --force \
     && apt-get purge -y --auto-remove gnupg \
-    && rm -rf /var/lib/apt/lists/* /root/.npm /tmp/*
+    && rm -rf /var/lib/apt/lists/*
+
+# Split from the apt layer above: this churns with every claude-code CLI
+# release, while the OS/node layer above stays stable across those bumps.
+RUN npm install -g @anthropic-ai/claude-code \
+    && npm cache clean --force \
+    && rm -rf /root/.npm /tmp/*
 
 RUN useradd -m -s /bin/bash agent
 
@@ -56,12 +60,17 @@ RUN useradd -m -s /bin/bash agent
 # `uv run python -m roboco.mcp.<server>`. Without it, all 10 roboco MCP
 # servers fail to start and the agent falls back to raw HTTP, losing every
 # guardrail and inline schema the MCP layer provides.
-COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
+COPY --from=ghcr.io/astral-sh/uv:0.11 /uv /usr/local/bin/uv
 
 WORKDIR /app
 
-# Copy the pre-built venv + source from builder, owned by agent user
-COPY --from=builder --chown=agent:agent /app /app
+# Copy the pre-built venv + source from builder, owned by agent user.
+# .venv first (invalidated only by pyproject.toml/uv.lock changes via the
+# builder's own dep-then-project split), source dirs last so an app-code-only
+# change doesn't bust the much larger .venv layer's cache.
+COPY --from=builder --chown=agent:agent /app/.venv /app/.venv
+COPY --from=builder --chown=agent:agent /app/pyproject.toml /app/uv.lock /app/README.md /app/
+COPY --from=builder --chown=agent:agent /app/roboco /app/roboco
 
 # Hook scripts: 0755 so the `agent` user (not root) can read+execute them.
 # SessionStart hook runs these as agent; stricter perms break the hook with