chore(docker): lean images — drop unused playwright, dedupe grok layer, cache-stable /app layering

- agent-dev-fe / agent-qa-fe: remove playwright chromium + its system libs (~770MB each; verified unused — panel tests are vitest, e2e harness is scripted Python; pnpm kept)
- agent-grok: drop the redundant chown -R that duplicated the 149MB CLI tree into a second layer (install already runs as agent)
- agent-base + orchestrator runners: split the single /app COPY into .venv-first / source-last layers so a source-only deploy re-layers ~13MB instead of ~380MB per image
- agent-base: split the 813MB apt+node+claude-code RUN so a CLI bump no longer re-downloads the OS/node layer
- .dockerignore: exclude gitignored docs/internal from the orchestrator's docs COPY; pin uv helper image to 0.11
- verified: all four images rebuilt + runtime-probed (claude/git/jq/node/uv/pnpm/grok, import roboco, docs/alembic/agents present); .venv layer proven CACHED across a source-only change

docker/agent-qa-fe.Dockerfile

@@ -1,35 +1,13 @@
 # Frontend QA Agent
-# Browser testing and accessibility tools
+# Accessibility and code-level testing tools
 
 FROM roboco-agent-base
 
 USER root
 
-# Playwright system dependencies (same as fe-dev)
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    libnss3 \
-    libnspr4 \
-    libatk1.0-0 \
-    libatk-bridge2.0-0 \
-    libcups2 \
-    libdrm2 \
-    libxkbcommon0 \
-    libxcomposite1 \
-    libxdamage1 \
-    libxfixes3 \
-    libxrandr2 \
-    libgbm1 \
-    libasound2 \
-    libpango-1.0-0 \
-    libcairo2 \
-    && rm -rf /var/lib/apt/lists/*
-
 RUN npm install -g pnpm
 
 USER agent
 
-# Playwright for browser testing
-RUN npx playwright install chromium
-
 LABEL role="frontend-qa"
-LABEL description="Frontend QA agent - browser testing, accessibility, visual regression"
+LABEL description="Frontend QA agent - accessibility, code review, testing"