build(docker): reduce runtime image size

[TNT-Likely]

Background

PanWatch 0.17.0 images download approximately 459–465 MiB per architecture. Build tools, the graphics driver stack, and precompiled Python bytecode add avoidable weight to deployments.

Changes

• Build Python dependencies in a separate stage and copy installed packages into a Bookworm runtime image. Keep Git and Perl in the builder, install local packages as regular wheels, and use the Chromium/PDF runtime library set without GTK/EGL or the Trixie Mesa/LLVM dependency chain.
• Separate runtime requirements from the development test runner and omit precompiled bytecode from production images.
• Install only Chromium's headless shell and let Playwright reconcile persisted browser caches with its required version.
• Add native AMD64/ARM64 image smoke checks for package imports, PDF export, screenshots, health, and frontend startup. Update dependency-change triggers, browser setup tests, and English/Chinese documentation.

Validation

• Built both linux/arm64 and linux/amd64 images. Compressed layers measured 291.8 MiB and 294.7 MiB respectively, approximately 36.5% smaller than 0.17.0.
• ARM64 image: python -m pytest tests/ --ignore=tests/test_makefile_windows.py -x -q — 890 passed, 1 skipped; python -m pytest packages/marketdata/tests -q — 188 passed; local agent package suites — 54 passed.
• .venv/bin/python -m pytest tests/test_makefile_windows.py -q — 4 passed, 2 platform skips.
• docker run --rm -v "$PWD:/checks:ro" panwatch:docker-optimized python /checks/scripts/docker_smoke.py — all ARM64 checks passed. AMD64 package imports, PDF exports, and separate HTTP startup checks passed under emulation.
• Release workflow ran python -m pytest tests/ -x -q and python -m pytest packages/marketdata/tests -q, then successfully published sunxiao0721/panwatch:0.17.0-docker-opt-968fd04 for both architectures.
• Docker image compatibility workflow — package imports, Chinese/English PDF exports, screenshots, health, and frontend startup passed on native AMD64 and ARM64 runners.
• JavaScript runtime compatibility workflow — full backend and marketdata suites plus all four native runtime matrix checks passed.
• git diff --check — passed.

Boundaries and risks

Full CJK fonts and runtime features remain included. Chromium continues to download into the data volume; startup now invokes the cached installer to detect missing or stale browser revisions. Most Python dependencies retain their existing lower-bound version constraints.

Follow-up

None.