chore: update dockerfile

[0xOsiris]

Note

Low Risk
Low risk Docker build change; it only affects image dependencies and should mainly impact build reproducibility and runtime tooling availability.

Overview
Improves Docker image reliability by installing sccache with --locked to ensure Cargo.lock is respected during builds.

Updates the runtime Debian image to also install curl alongside existing packages.

^{Reviewed by Cursor Bugbot for commit 9ab8e33. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9ab8e33. Configure here.}

[cursor]

Missing --locked flag on cargo-chef install

Low Severity

The --locked flag was added to cargo install sccache but not to the adjacent cargo install cargo-chef command. Both tools are installed the same way, so the inconsistency looks like an oversight. Without --locked, cargo-chef can resolve different transitive dependency versions than what its Cargo.lock specifies, undermining the reproducibility improvement intended by this change.

 

^{Reviewed by Cursor Bugbot for commit 9ab8e33. Configure here.}