chore(docker): lean images — drop unused playwright, dedupe grok layer, cache-stable /app layering

- agent-dev-fe / agent-qa-fe: remove playwright chromium + its system libs (~770MB each; verified unused — panel tests are vitest, e2e harness is scripted Python; pnpm kept)
- agent-grok: drop the redundant chown -R that duplicated the 149MB CLI tree into a second layer (install already runs as agent)
- agent-base + orchestrator runners: split the single /app COPY into .venv-first / source-last layers so a source-only deploy re-layers ~13MB instead of ~380MB per image
- agent-base: split the 813MB apt+node+claude-code RUN so a CLI bump no longer re-downloads the OS/node layer
- .dockerignore: exclude gitignored docs/internal from the orchestrator's docs COPY; pin uv helper image to 0.11
- verified: all four images rebuilt + runtime-probed (claude/git/jq/node/uv/pnpm/grok, import roboco, docs/alembic/agents present); .venv layer proven CACHED across a source-only change

docker/agent-grok.Dockerfile

@@ -30,10 +30,10 @@ RUN su agent -s /bin/bash -c "set -euo pipefail; export HOME=/home/agent; \
     && rm -rf /tmp/*
 
 # Entrypoint: render ~/.grok/config.toml + the per-role flags, then run grok
-# headless (overrides the base image's `claude` entrypoint).
+# headless (overrides the base image's `claude` entrypoint). ~/.grok is already
+# agent:agent-owned (installed above via `su agent`), so no chown needed here.
 COPY docker/scripts/grok-cli-agent-entrypoint.sh /app/scripts/grok-cli-agent-entrypoint.sh
-RUN chmod 0755 /app/scripts/grok-cli-agent-entrypoint.sh \
-    && chown -R agent:agent /home/agent/.grok
+RUN chmod 0755 /app/scripts/grok-cli-agent-entrypoint.sh
 
 USER agent