chore: self-bootstrapping CI — build Docker image inline, cache by content hash

Move Docker image build into the evals workflow as a dependency job.
Image tag is keyed on hash of Dockerfile+lockfile+package.json — only
rebuilds when those change. Eliminates chicken-and-egg problem where
the image must exist before the first PR run.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/ci-image.yml

@@ -10,6 +10,13 @@ on:
       - '.github/docker/Dockerfile.ci'
       - 'bun.lockb'
       - 'package.json'
+  # Build on PRs that change the image (so first PR run has it)
+  pull_request:
+    branches: [main]
+    paths:
+      - '.github/docker/Dockerfile.ci'
+      - 'bun.lockb'
+      - 'package.json'
   # Manual trigger
   workflow_dispatch: