fix: pin the claude CLI to an exact version in the CI image + tripwire

The image installed @anthropic-ai/claude-code UNPINNED and rebuilt weekly
'to pick up CLI updates' — while bun sat carefully pinned at 1.3.13 two RUN
lines above. The PTY harness screen-scrapes this CLI's TUI, and that drift
broke it three separate times (welcome-screen wedge on 2.1.233, skillify
HOME discovery on 2.1.237, guard/freeze hooks on 2.1.162), each debugged as
a flake first. Pin 2.1.251 (current latest), bump deliberately via a PR
that runs the PTY gate, and enforce with test/ci-image-cli-pin.test.ts:
any global npm install in Dockerfile.ci without an exact @X.Y.Z pin fails
the free suite. The weekly ci-image cron stays as a cheap tag self-heal.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/ci-image.yml

@@ -1,8 +1,12 @@
 name: Build CI Image
 on:
-  # Rebuild weekly (Monday 4am UTC) to pick up CLI updates — deliberately 2h
-  # BEFORE evals-periodic's 6am cron so the weekly eval run finds a fresh
-  # image instead of racing a half-pushed tag or duplicating the build.
+  # Weekly self-heal (Monday 4am UTC) — deliberately 2h BEFORE
+  # evals-periodic's 6am cron so the weekly eval run finds the image instead
+  # of racing a half-pushed tag. With the claude CLI pinned in Dockerfile.ci
+  # (v1.76+), this cron no longer pulls CLI updates: when the content-hash
+  # tag already exists it's a ~30s no-op, and it only rebuilds if the tag
+  # was somehow lost. CLI bumps happen by editing the Dockerfile pin in a PR
+  # that runs the PTY gate against the new TUI.
   schedule:
     - cron: '0 4 * * 1'
   # Rebuild on Dockerfile or lockfile changes. package.json is deliberately