fix(ci): restore Docker image builds

[MiaoDX]

Summary

• Replace the removed Debian libgl1-mesa-glx package with libgl1 in the CPU Docker image build.
• Copy README.md into both Docker metadata install layers so Hatchling can validate readme = "README.md" during editable installs.
• Add contract tests to keep the Dockerfile metadata assumptions from regressing.

Root Cause

The failing Build CI Docker Image workflow was resolving python:3.12-slim to Debian trixie, where libgl1-mesa-glx has no package candidate. The GPU Dockerfile also installed from pyproject.toml without copying README.md, which breaks Hatchling metadata validation.

Test Coverage

All new behavior is covered by Dockerfile contract tests.

Validation

• docker run --rm python:3.12-slim ... apt-cache policy ... confirmed libgl1-mesa-glx is unavailable and libgl1 is available.
• Focused Docker build using the corrected CPU apt layer and metadata copy completed through uv pip install -e ".[demo,dev]".
• Metadata-only Hatchling editable install check passed with pyproject.toml, README.md, and package stub present.
• uv run pytest --no-cov tests/contract/test_dockerfiles.py -q passed: 2 passed.
• uv run ruff check . passed.
• uv run ruff format --check . passed.
• uv run mypy src/ passed.
• MUJOCO_GL=osmesa uv run pytest -q passed: 572 passed, 3 skipped, coverage 91.88%.

Test Plan

• Docker package availability checked against python:3.12-slim.
• Focused Docker build validated past the original failing layers.
• Contract tests, lint, format check, type check, and full pytest passed locally.