ci: Sprint 04 — CI/CD reliability (BuildKit docs, cache-to, version pins, cleanup, compose validation)

- Document DOCKER_BUILDKIT=0 rationale in all deploy workflows
- Add --cache-to type=inline to all docker build commands
- Pin Python 3.12 and Node 20 with version assertions in CI
- Remove dead test-summary job from test.yml
- Reconcile required-tools.txt with Dockerfile.base (bash, ca-certificates, openssh-client)
- Clean up stale artifacts (Dockerfile comment, orphaned .md files)
- Add docker-compose config validation before claude-dev deploy

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -26,6 +26,7 @@ jobs:
       - name: Setup Python
         run: |
           python3 --version
+          python3 -c "import sys; assert sys.version_info[:2] == (3, 12), f'Expected Python 3.12, got {sys.version}'; print('Python 3.12 confirmed')"
           pip3 --version
 
       - name: Cache Python dependencies
@@ -102,6 +103,7 @@ jobs:
       - name: Setup Node.js
         run: |
           node --version
+          node -e "assert(process.version.startsWith('v20'), 'Expected Node 20, got ' + process.version); console.log('Node 20 confirmed')"
           npm --version
 
       - name: Cache Node dependencies
@@ -208,7 +210,12 @@ jobs:
         run: |
           set -e
           export DOCKER_API_VERSION=1.43
-          if ! DOCKER_BUILDKIT=0 docker build --cache-from nas-dashboard:latest -t nas-dashboard:latest dashboard/; then
+          # DOCKER_BUILDKIT=0 is required for Synology ContainerManager's Docker daemon,
+          # which does not support BuildKit syntax. Remove when Synology updates to a
+          # Docker Engine version with full BuildKit support (currently 24.x, needs 23+).
+          # --cache-to type=inline is a no-op while BuildKit is disabled; it activates
+          # automatically when DOCKER_BUILDKIT=0 is removed.
+          if ! DOCKER_BUILDKIT=0 docker build --cache-from nas-dashboard:latest --cache-to type=inline -t nas-dashboard:latest dashboard/; then
             echo "Build failed. Checking for network issues..."
             curl -I https://registry.npmmirror.com || echo "npmmirror unreachable"
             curl -I https://pypi.tuna.tsinghua.edu.cn || echo "Tsinghua PyPI unreachable"