Fold the base/app split back into a single Dockerfile. The base tag was
never published, so a plain `docker build -t ouroboros-web .` failed on
every fresh machine, and a runtime `UV_PROJECT_ENVIRONMENT` let an agent's
`uv sync` in a task workspace rewrite the runtime venv. What the split was
for stays: the Playwright browsers pinned to the locked version are
installed from an ephemeral uvx tool environment into `/ms-playwright`
above `COPY pyproject.toml uv.lock` (every release rewrites the lock), and
the BuildKit cache mounts keep the uv and apt caches out of the layers
(4.82 GB -> 4.12 GB). The tag-only docker lanes stop forcing
`PLAYWRIGHT_BROWSERS_PATH=0`, which pointed at an empty package tree and
made them download browsers mid-test; the portable path-length test reads
the shipped browser path. The Russian Trusted CA files leave the image:
the next commit gives deployments an owner-side setting instead.
Docs: ARCHITECTURE §8 Docker, README.
9637d194c2