ci: Sprint 04 — CI/CD reliability (BuildKit docs, cache-to, version pins, cleanup, compose validation)

- Document DOCKER_BUILDKIT=0 rationale in all deploy workflows
- Add --cache-to type=inline to all docker build commands
- Pin Python 3.12 and Node 20 with version assertions in CI
- Remove dead test-summary job from test.yml
- Reconcile required-tools.txt with Dockerfile.base (bash, ca-certificates, openssh-client)
- Clean up stale artifacts (Dockerfile comment, orphaned .md files)
- Add docker-compose config validation before claude-dev deploy

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/deploy-dev.yml

@@ -185,7 +185,12 @@ jobs:
         run: |
           set -e
           export DOCKER_API_VERSION=1.43
-          if ! DOCKER_BUILDKIT=0 docker build --cache-from nas-dashboard-dev:latest -t nas-dashboard-dev:latest dashboard/; then
+          # DOCKER_BUILDKIT=0 is required for Synology ContainerManager's Docker daemon,
+          # which does not support BuildKit syntax. Remove when Synology updates to a
+          # Docker Engine version with full BuildKit support (currently 24.x, needs 23+).
+          # --cache-to type=inline is a no-op while BuildKit is disabled; it activates
+          # automatically when DOCKER_BUILDKIT=0 is removed.
+          if ! DOCKER_BUILDKIT=0 docker build --cache-from nas-dashboard-dev:latest --cache-to type=inline -t nas-dashboard-dev:latest dashboard/; then
             echo "Build failed. Checking for network issues..."
             curl -I https://registry.npmmirror.com || echo "npmmirror unreachable"
             curl -I https://pypi.tuna.tsinghua.edu.cn || echo "Tsinghua PyPI unreachable"