fix(docker): remove build artifacts from image layers

[nightcityblade]

Summary

Fixes #2092.

Keep Playwright installation, runtime-cache copying, and root-cache cleanup in one Docker layer so the superseded root-owned browser cache is not committed to the image. Remove QEMU core dumps immediately after crawl4ai-doctor, before that layer is committed.

List of files changed and why

• Dockerfile - clean duplicate Playwright data and doctor core dumps in the same layers that create them.
• deploy/docker/tests/test_security_container_posture.py - enforce both same-layer cleanup guarantees.

How Has This Been Tested?

• docker buildx build --check --progress plain . — check complete, no warnings found.
• .venv/bin/python -m pytest deploy/docker/tests/test_security_*.py -q — 317 passed, 1 xfailed.
• .venv/bin/black --check --target-version py312 deploy/docker/tests/test_security_container_posture.py — passed.
• .venv/bin/ruff check deploy/docker/tests/test_security_container_posture.py — passed.
• git diff --check — passed.

A full multi-architecture image build was not run locally; the focused posture test verifies that each cleanup remains in the Docker layer that creates its artifact.

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas — N/A; the cleanup commands and focused assertions are self-explanatory.
• I have made corresponding changes to the documentation — N/A; this changes image contents without changing user-facing behavior.
• I have added/updated unit tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

[nightcityblade]

CI follow-up: both Security jobs pass. The only failure is the Discord notification job, whose log reports that DISCORD_WEBHOOK is not defined; this is a repository workflow-secret issue rather than a failure in the Dockerfile change.