Optimize Docker image build caching

[k15z]

Summary

• split Docker runtime dependency installation from training source so app-only changes do not rebuild the large Torch/CUDA layer
• use GHCR registry cache refs for CPU merge builds and inline cache for CUDA merge builds to avoid the huge separate CUDA cache export
• add a temporary PR Docker smoke build matrix to test image build timing without publishing runtime tags
• pin Docker image torch wheels to the PyTorch CPU/CUDA 12.6 indexes for reproducible cache keys
• preserve build cache tags during cleanup

Validation

• docker buildx build --check .
• local CPU image build and runtime smoke test (torch 2.11.0+cpu, hexchess.num_move_indices() == 4206)
• Docker CUDA dependency dry run resolves torch==2.11.0+cu126 from the PyTorch index
• ruby YAML parse for Docker and cleanup workflows
• git diff --check
• codex review --uncommitted
• codex review --base main ran; its arm64 Torch-pin concern was checked against the live PR log and disproven by a successful torch==2.11.0+cpu aarch64 wheel install
• PR Docker run 25615637956: cpu-amd64 19s, cpu-arm64 2m13s, cuda-amd64 2m21s
• PR CI run 25615637953: Rust tests, clippy, fmt, WASM build, Python lint/tests all green
• Docs check run 25615637946 green

Notes

The PR smoke build proves the no-publish build path is under 4 minutes. The remaining proof is the actual main publish workflow after merge.