ci(docker): install @studio-saelix/sencho-pro in production builds (#881)

Phase 2b of the open-core hybrid extraction. After Phase 2a (PR #880)
wired the public-side loader to dynamic-import the private package,
this PR makes production Docker builds actually install the package
so the runtime path uses it. Single image; saelix/sencho remains the
only published image (the original ADR's dual-image plan was rejected
because customers buying paid tiers would otherwise need GitHub auth
to pull a second image, breaking the purchase flow).

Dockerfile (prod-deps stage): a new RUN block after npm ci installs
@studio-saelix/sencho-pro using a BuildKit secret-mounted github_token
for npm.pkg.github.com auth. The .npmrc carrying the token is written
and removed inside the same RUN, plus /root/.npm is wiped to scrub
any verbose-log artifacts that npm might otherwise stash. The token
never enters an image layer (BuildKit excludes secret content from
both layer filesystems and cache keys; docker history shows the
literal $(cat /run/secrets/...) command, not the substituted value).

PRO_PACKAGE_VERSION is a build arg pinned by CI to a literal SemVer
(0.1.0 today) so the scan build and the publish build resolve to the
same package version. Default of `latest` keeps local builds
convenient. When the pro package ships a new version, bump the value
in docker-publish.yml in the same PR that ships the matching public
Sencho release; release-please does not coordinate the two cadences.

Empty-secret branch (no github_token provided, e.g. local dev or
fork PRs) skips the install and prints a notice. The resulting image
runs through the loader's in-tree LicenseService fallback, so PR
validation builds and contributor builds work without any GitHub
auth setup.

docker-publish.yml: both build-push-action invocations (the
pre-publish scan and the multi-arch publish) pass the github_token
secret and PRO_PACKAGE_VERSION build arg. The auto-provisioned
GITHUB_TOKEN's packages:read scope is sufficient because the public
Sencho repo and the private package live in the same Studio-Saelix
GitHub org. Moving the package to a different org would silently
break this contract; the Dockerfile comment block records the
invariant.

ci.yml is intentionally not changed. The PR-time Docker validation
job builds without the secret and exercises the loader's in-tree
fallback path, which is correct for fork PRs (no token access) and
useful for catching fallback-path regressions.

Test plan: tsc clean (no TS changes). The dockerfile install path is
exercised by the next release's pre-publish scan + smoke test, both
of which boot the actual image and call /api/health. Failed dynamic
import or constructor throw would block bootstrap before the listener
binds, so the existing smoke test covers the runtime contract.

Dockerfile

@@ -90,6 +90,45 @@ RUN if [ "$TARGETARCH" = "$BUILDARCH" ]; then \
         npm ci --omit=dev; \
     fi
 
+# Add the private @studio-saelix/sencho-pro package on top of the
+# production dependencies installed above. The package contains the
+# Lemon Squeezy validation client; the public Sencho core's
+# loadEntitlementProvider() dynamic-imports it at runtime when present
+# and falls back to the in-tree LicenseService when it is not.
+#
+# Authentication uses a BuildKit secret rather than a build arg so the
+# token never lands in an image layer. The github_token secret is
+# expected to carry packages:read scope against the Studio-Saelix org;
+# CI passes the auto-provisioned GITHUB_TOKEN, which has that scope
+# automatically because the public Sencho repo and the private package
+# are in the same GitHub org. Moving the package to a different org
+# would silently break this contract; the auto-token would lose scope
+# and every build would fall through to the empty-secret branch.
+# Local builds without the secret skip the install entirely and the
+# resulting image runs through the loader's in-tree fallback.
+#
+# The install is pure-JS (axios is the only runtime dep, no native
+# modules) so cross-compilation env vars are not needed here. We use
+# `npm install --no-save` so package.json and package-lock.json stay
+# unchanged in the source tree; the package is added to node_modules
+# only inside this build layer.
+#
+# PRO_PACKAGE_VERSION is pinned by CI at build time (a literal SemVer
+# like `0.1.0`) so the scan build and the publish build resolve to the
+# same package version. Defaulting to `latest` keeps local builds
+# convenient; CI overrides this so production never tracks a moving
+# tag.
+ARG PRO_PACKAGE_VERSION=latest
+RUN --mount=type=secret,id=github_token \
+    if [ -s /run/secrets/github_token ]; then \
+      printf '@studio-saelix:registry=https://npm.pkg.github.com\n//npm.pkg.github.com/:_authToken=%s\n' "$(cat /run/secrets/github_token)" > /root/.npmrc && \
+      npm install --no-save --omit=dev "@studio-saelix/sencho-pro@${PRO_PACKAGE_VERSION}" && \
+      rm -f /root/.npmrc && \
+      rm -rf /root/.npm; \
+    else \
+      echo "[Sencho] No github_token secret provided; @studio-saelix/sencho-pro will not be installed. Loader will use the in-tree LicenseService fallback at runtime."; \
+    fi
+
 # Stage 4a: Build Docker CLI from source against Go 1.26.2
 #
 # CLI v29.4.1 ships otel/sdk v1.43.0, resolving CVE-2026-39883 (BSD kenv) and