Image size: add CI size-budget guard + show image size in aidc status --global

[ai-anant]

Problem

There's no guardrail against the image growing. The current state was reached organically (agents layer 981 MB, semgrep 710 MB, base features ~600 MB), and nothing in CI would catch a +500 MB regression in a future PR. The host build cache is already 45.5 GB with no visibility into what's in it.

Proposal

1. Size-report CI job (new .github/workflows/image-size.yml): on PR + main, build the Dockerfile template with a representative AIDC_TOOLCHAINS=go,node,python and print docker images size + top-10 docker history layers. Post the number as a PR comment (or fail a soft budget).
2. Budget assertion: fail CI if the representative image exceeds a threshold (start at current measured + 10%, tighten after the optimizations land).
3. aidc status --global: add image size per project (already lists disk/CPU/memory per container — docker image inspect size is a one-liner to add) so users can see the footprint of their fleet at a glance.
4. Optionally: aidc doctor-style check that warns when the shared base image needs a bump (docker image inspect aidc-base vs pinned digest).

Files

• .github/workflows/image-size.yml (new)
• lib/aidc.sh — aidc::cmd_status_global (image size column)
• docs/security.md or docs/install.md — documented size budget + how to check

Acceptance criteria

• A PR that adds a 100 MB install to the Dockerfile fails the size budget.
• aidc status --global shows image size per project.
• README documents the budget and current numbers.