Speed up CI and consolidate dependency updates

[ryanbaumann]

What changed

• makes the deployable Docker image the single full compilation and smoke boundary for pull requests
• removes the duplicate staged all-app build and redundant per-package build step while retaining isolated lint and unit tests
• skips GitHub's Docker verification on main, where the production Cloud Build already builds and smoke-tests the same commit
• adds an Artifact Registry build-cache tag and BuildKit inline cache metadata for Cloud Build
• disables npm audit and funding network requests during CI installs
• consolidates the 15 pending Dependabot updates across Atlas, Hairstyle AI Studio, Strava Explorer, Isochrones, and Air Quality Map
• migrates Hairstyle AI Studio's PostCSS integration and CSS entrypoint for Tailwind 4
• aligns react-dom with React 19.2.8 after the combined suite exposed React's exact-version requirement

Why

PR CI compiled the application graph three times: package builds, a staged all-app smoke build, and Docker. Pushes to main then repeated the Docker build in both GitHub Actions and Cloud Build. The dependency updates were also split across 15 overlapping Dependabot PRs, including a Tailwind major update that did not include its required PostCSS migration and a React-only update that failed against the older React DOM package.

This keeps one production-shaped compilation boundary per event while preserving package-level test isolation and gateway/container smoke coverage.

Validation

• npm run check:labs — passed
• npm run check:content — passed
• npm run test:labs — 47 passed
• cd gateway && npm test — 141 passed
• node scripts/build-local.mjs --skip-install --allow-missing-artifacts — all apps built and staged
• node scripts/smoke.mjs — 20 passed
• Atlas: clean npm ci, typecheck, 573 Vitest tests, 2 source-integrity tests, production build — passed
• Hairstyle AI Studio: clean npm ci, typecheck, 9 tests, production build, generated Tailwind utility audit — passed
• Strava Explorer: clean npm ci, lint, 38 tests, production build — passed
• Isochrones: clean npm ci, 5 tests, production build — passed
• Air Quality Map: clean npm ci, 2 tests, production build — passed
• exact requested versions verified in all five lockfiles
• git diff --check — passed

Follow-up evidence

The PR's GitHub Actions run will measure the reduced job/build time. The next successful production deployment will populate and then exercise the Cloud Build cache; no production build or deployment was triggered locally.