Dagger Lint fn: replace hadolint/hadolint-action in CI

[haydenk]

Parent

Part of #14

What to build

Add Lint(ctx, source *dagger.Directory, distro string) (string, error) to .dagger/main.go running hadolint inside a container. Replace the hadolint/hadolint-action step in ci.yml with dagger call lint --distro=....

Parse hadolint stdout to emit GitHub ::error file=...,line=...::... annotations so the PR experience matches what the action provided.

Acceptance criteria

• dagger call lint --source=. --distro=debian runs hadolint and returns its output
• Hadolint findings appear as PR annotations
• ci.yml no longer references hadolint/hadolint-action
• All six distros remain clean on master (no new findings)
• PAT-less; no third-party actions used

Blocked by

None — can start immediately.