feat(sprint-A16): build Docker reproductible (digest + lock file) — clôture M-2 df7146b unverified Claude commited on May 2