WASM builder Docker image: versioned, non-root, cache-mounted, GitLab-ready (#528 WP1) #529

Work package 1 of #528.

Current state (audit)

• src/cli/docker.zig (--docker, closed Support cross-compilation via Docker/Colima #112) builds only the core desktop target in a throwaway ubuntu:24.04 container, downloading Zig 0.16.0 at run time as root. Provider targets (wasm/web) are refused by pipeline/args_resolve.zig:dockerRefused (RFC cli#466 D5), so there is no container path for WASM today.
• Flying Platform's test-game-wasm job runs on a shell executor (fp-ubuntu), with toolchains installed into the runner home via tools/ci/ensure-tool.sh. A CI image: has no effect there.

Scope

• Versioned builder image (Dockerfile + build/publish automation) with pinned base image, Zig, labelle CLI/assembler, Emscripten, Node, Python; record a toolchain inventory in the image.
• System deps incl. libatomic1 and Chromium WASM smoke-test deps (FP tools/web_smoke).
• Non-root user; no credentials or game source in the image.
• Respect project.labelle / labelle.lock pins; document image/toolkit compatibility.
• Toolchains in the image; Zig local/global caches, labelle package caches and emsdk caches mounted outside it. Document mounts, ownership, cache keys and invalidation (toolchain/platform/build config).
• Publish to an agreed registry; consumers pin immutable digests; document upgrade and rollback.
• GitLab CI example (Docker executor) plus CPU/memory/concurrency guidance from measured peaks (parent baseline: ~10.4 GiB peak before the serializer fix).
• Decide whether --docker should reuse this image; do not add a second, divergent container path.
• Android SDK/NDK stays out (separate future variant; see --docker with --platform=android builds for the HOST target and can't see sibling path deps #331).

Acceptance

• Image builds reproducibly and is published with a version tag + digest.
• A fresh container builds FP's WASM bundle as non-root with no host toolchains; a second fresh container reuses mounted caches.
• Docs: GitLab usage, cache layout/invalidation, upgrade/rollback, resource limits.

Parent: #528. Local prototype evidence (Windows, 2026-10-30) lives under D:/prj/labelle-toolkit/wasm-investigation-evidence; attach the reproducible scripts/results/patch to the implementing PR rather than depending on that machine.