ci: cap Docker image build time (#405)

## Summary
- cap Docker image publish job and build steps
- stop multi-arch QEMU builds; publish amd64 only
- cache production Docker dependency layers before app copy
- add tests that guard CI timeout/platform behavior

## Verification
- vendor/bin/pint --dirty --format agent
- php artisan test --compact tests/Feature/CiDockerBuildTest.php

.github/workflows/ci.yml

@@ -346,6 +346,7 @@ jobs:
 
   build-image:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     needs: [tests, linter, static-analysis, performance-tests, changes]
     if: ((github.ref == 'refs/heads/main' && github.event_name == 'push') || github.event_name == 'workflow_dispatch') && needs.changes.outputs.code == 'true'
     env:
@@ -375,9 +376,6 @@ jobs:
           sentry-cli releases set-commits "$SENTRY_RELEASE" --auto --ignore-missing
           sentry-cli releases finalize "$SENTRY_RELEASE"
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -413,9 +411,10 @@ jobs:
 
       - name: Build and push development image
         uses: docker/build-push-action@v6
+        timeout-minutes: 20
         with:
           context: .
-          platforms: linux/amd64,linux/arm64
+          platforms: linux/amd64
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
@@ -426,10 +425,11 @@ jobs:
 
       - name: Build and push production image
         uses: docker/build-push-action@v6
+        timeout-minutes: 25
         with:
           context: .
           file: Dockerfile.production
-          platforms: linux/amd64,linux/arm64
+          platforms: linux/amd64
           push: true
           tags: ${{ steps.production-meta.outputs.tags }}
           labels: ${{ steps.production-meta.outputs.labels }}

Dockerfile.production

@@ -47,18 +47,21 @@ WORKDIR /app
 
 ENV SENTRY_RELEASE=${SENTRY_RELEASE}
 
+# Copy dependency manifests first so Docker can reuse install layers across code changes
+COPY composer.json composer.lock ./
+RUN composer install --no-dev --no-scripts --no-interaction --prefer-dist --optimize-autoloader
+
+COPY package.json bun.lock ./
+COPY scripts ./scripts
+RUN bun install --frozen-lockfile
+
 # Copy application files
 COPY . /app/.
+RUN composer dump-autoload --no-dev --optimize
 
 # Create necessary directories
 RUN mkdir -p /var/log/nginx && mkdir -p /var/cache/nginx
 
-# Install PHP dependencies
-RUN composer install --no-dev --optimize-autoloader
-
-# Install Node.js dependencies
-RUN bun install --frozen-lockfile
-
 # Build assets with HIDE_AUTH_BUTTONS=false so Wayfinder generates all routes
 # (HIDE_AUTH_BUTTONS will be set to true at runtime via .env)
 RUN HIDE_AUTH_BUTTONS=false bun run build:ssr