fix: harden Linux Docker dependency verification

[amitbreuer]

Summary

• Add a linux/amd64 production Docker build check for pull requests without deployment or cloud credentials.
• Explicitly include development and optional build dependencies, verify native build-tool imports early, and print captured npm diagnostics only on failure.
• Document reproducible Linux build checks while preserving existing dependency versions and lockfile.

Verification reported by implementation session

• Both original and hardened Linux/amd64 images built successfully using the exact cloud base digest (Node 22.23.2 / npm 10.9.8).
• The cloud source lockfile was byte-identical. Cloud installed 564 packages versus 566 locally.
• The cause of the optional-dependency omission remains unproven. This improves detection and diagnostics; it is not a demonstrated fix for the original cloud failure.

Deployment boundaries

No deployment, cloud configuration changes, or merge was performed. Party enablement still requires provider credentials, production migrations, Cloud Tasks/IAM/secrets and real Telegram/provider verification. The existing Brewtify bot and app remain the target.