Prevent dependency cache copies in runtime image

[owenshuo]

/claim #4132

Summary

• add a narrow multi-stage Dockerfile that installs production dependencies with pip cache disabled and copies only runtime dependency/app artifact paths into the final image
• add a runtime image inspection script that fails when dependency manager cache directories are present
• add CI coverage that builds the runtime image and runs the cache inspection check

Verification

• python3 -m pytest tests/test_image_cache_inspection.py -q
• python3 -m flake8 scripts/inspect_image_caches.py tests/test_image_cache_inspection.py
• git diff --check
• docker build -t agent-orchestrator:cache-audit .
• python3 scripts/inspect_image_caches.py agent-orchestrator:cache-audit