Local-reproducibility helper: `dagger call ci`

[haydenk]

Parent

Part of #14

What to build

Add top-level Ci(ctx, source *dagger.Directory) (string, error) to .dagger/main.go that:

• Loads matrix.json
• Runs Lint + Build + Test in parallel for every matrix entry
• Surfaces which distro/version failed (if any)

Document in README.md "Building Locally" section.

Acceptance criteria

• dagger call ci --source=. runs the entire matrix locally
• Failures clearly identify the failing distro/version
• README updated with the new command and example output
• No third-party actions involved

Blocked by

• Dagger Lint fn: replace hadolint/hadolint-action in CI #17 (Lint)
• Dagger Test fn: replace inline docker run asserts in CI #18 (Test)
• Dagger Build fn (CI side only) #19 (Build)