ci: Sprint 04 — CI/CD reliability (BuildKit docs, cache-to, version pins, cleanup, compose validation)

- Document DOCKER_BUILDKIT=0 rationale in all deploy workflows
- Add --cache-to type=inline to all docker build commands
- Pin Python 3.12 and Node 20 with version assertions in CI
- Remove dead test-summary job from test.yml
- Reconcile required-tools.txt with Dockerfile.base (bash, ca-certificates, openssh-client)
- Clean up stale artifacts (Dockerfile comment, orphaned .md files)
- Add docker-compose config validation before claude-dev deploy

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/deploy-claude-dev-dev.yml

@@ -51,9 +51,14 @@ jobs:
           set -euo pipefail
           export DOCKER_API_VERSION=1.43
           # Check if base image exists, build if missing
+          # DOCKER_BUILDKIT=0 is required for Synology ContainerManager's Docker daemon,
+          # which does not support BuildKit syntax. Remove when Synology updates to a
+          # Docker Engine version with full BuildKit support (currently 24.x, needs 23+).
+          # --cache-to type=inline is a no-op while BuildKit is disabled.
           if ! docker image inspect claude-dev-base:latest >/dev/null 2>&1; then
             echo "Base image not found, building claude-dev-base:latest..."
             DOCKER_BUILDKIT=0 docker build \
+              --cache-to type=inline \
               -f claude-dev/Dockerfile.base \
               -t claude-dev-base:latest \
               claude-dev/
@@ -64,6 +69,7 @@ jobs:
           # Build runtime image (fast, just copies scripts)
           DOCKER_BUILDKIT=0 docker build \
             --cache-from claude-dev:latest \
+            --cache-to type=inline \
             -t "$CLAUDE_DEV_IMAGE" \
             -t claude-dev:latest \
             claude-dev/
@@ -115,6 +121,17 @@ jobs:
           cp claude-dev/docker-compose.yml /volume1/docker/claude-dev/docker-compose.yml
           printf '%s\n' "$CLAUDE_DEV_IMAGE_TAG" > /volume1/docker/claude-dev/target-tag.txt
 
+      - name: Validate compose config
+        run: |
+          set -euo pipefail
+          export DOCKER_API_VERSION=1.43
+          if ! docker compose -f /volume1/docker/claude-dev/docker-compose.yml config >/dev/null; then
+            echo "❌ docker-compose config validation failed"
+            docker compose -f /volume1/docker/claude-dev/docker-compose.yml config
+            exit 1
+          fi
+          echo "✅ docker-compose config is valid"
+
       - name: Remove stale claude-dev container
         run: |
           export DOCKER_API_VERSION=1.43