fix: Docker/CI build hygiene issues from #79

- Drop silent uv sync fallback in Dockerfile so lockfile drift fails
  the build loudly instead of producing an unpinned, unsigned image
- Split Dockerfile into builder/runtime stages so the runtime image
  runs python -m server.main directly instead of re-resolving the
  env via `uv run` at container start, and no longer ships uv
- Align setup-uv action version to v7 in both CI lint and test jobs

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: GoodbyePlanet

.github/workflows/ci.yml

@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: astral-sh/setup-uv@v5
+      - uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
       - name: Install dependencies

Dockerfile

@@ -1,17 +1,25 @@
-FROM python:3.12-slim AS runtime
+FROM python:3.12-slim AS builder
 
 COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
 
 WORKDIR /app
 
-# Install Python dependencies
-COPY pyproject.toml uv.lock* ./
-RUN uv sync --frozen --no-dev --no-editable 2>/dev/null || uv sync --no-dev --no-editable
+# Install Python dependencies (fails loudly on lockfile drift instead of silently re-resolving)
+COPY pyproject.toml uv.lock ./
+RUN uv sync --frozen --no-dev --no-editable
 
 # Copy server source and config
 COPY server/ ./server/
 COPY config.yaml ./
 
+FROM python:3.12-slim AS runtime
+
+WORKDIR /app
+
+COPY --from=builder /app /app
+
+ENV PATH="/app/.venv/bin:$PATH"
+
 EXPOSE 8090
 
-CMD ["uv", "run", "python", "-m", "server.main"]
+CMD ["python", "-m", "server.main"]