ci: build the Docker images and run tests on the runtime they ship

Found during the review of #180.

CI runs node-version: 24 and pnpm 10.33.4 (from packageManager). Both production images are node:20-alpine with corepack prepare pnpm@9.15.0. No job builds either Dockerfile.

So a green CI run does not establish that the image builds, that the pruned lockfile installs under the pnpm the image uses, or that apps/worker/dist/index.js runs on Node 20 — while the incident CI is now guarding against was a deploy-time failure.

This is not hypothetical for #180 specifically: the timeout handling in apps/worker/start.sh depends on busybox timeout semantics (exit 143, not GNU's 124), which is an alpine-only property. #180 added a CI step that executes start.sh against a stub, which covers the branching — but it runs under bash on ubuntu, so the busybox-specific behaviour is still unverified in CI.

Building apps/worker/Dockerfile and running the startup guard inside it would close both gaps.

Start with apps/worker/Dockerfile and apps/worker/start.sh, then inspect the existing CI job and the startup guard added for #180. Build the worker image and run the startup guard inside the Alpine-based runtime, verifying the pruned lockfile installs with the image's pnpm and that apps/worker/dist/index.js runs on Node 20.】【。