CI: add docker-ce-cli to runner-base image

docker/login-action requires the docker CLI binary in the job container.
The daemon is provided by the host socket mount; only the CLI is needed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

infra/Dockerfile.runner-base

@@ -14,6 +14,8 @@ FROM ubuntu:24.04
 ENV DEBIAN_FRONTEND=noninteractive
 
 # Python 3.12 ships in Ubuntu 24.04 main repos — no PPA needed.
+# Docker CLI is needed by docker/login-action and docker/build-push-action
+# (the daemon itself comes from the host socket mount).
 RUN apt-get update -qq && \
     apt-get install -y -qq \
       python3.12 python3.12-dev python3.12-venv python3-pip \
@@ -21,4 +23,12 @@ RUN apt-get update -qq && \
     # Node 22 LTS via NodeSource
     curl -fsSL https://deb.nodesource.com/setup_22.x | bash - && \
     apt-get install -y -qq nodejs && \
+    # Docker CLI via Docker's official apt repo
+    install -m 0755 -d /etc/apt/keyrings && \
+    curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc && \
+    chmod a+r /etc/apt/keyrings/docker.asc && \
+    echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \
+      > /etc/apt/sources.list.d/docker.list && \
+    apt-get update -qq && \
+    apt-get install -y -qq docker-ce-cli && \
     apt-get clean && rm -rf /var/lib/apt/lists/*