Add Docker image and core container CI

[rickyjreyes]

Summary

• adds a non-root CPU Docker image for the WaveLock node and installed CLIs
• excludes runtime ledgers, commitments, keys, tests, and research artifacts from the image
• adds fast core tests, CLI smoke tests, and Docker build/run checks
• preserves the existing PDE and curvature audit workflows unchanged

CI scope

Long-running search and audit workloads remain outside ordinary pull-request CI.