[Chore] Introduce Docker-based build system for consistent license-file generation

## Summary
Introduce a **Docker-based build system** so that license-file generation (and the rest of the build) is **byte-identical across host operating systems** (Linux / macOS / Windows).

## Motivation
Today contributors on different OSes produce slightly different output (line endings, sort order, timestamps, file ordering) for generated `LICENSE` / `NOTICE` / 3rd-party-license artifacts, leading to noisy diffs and CI churn. A Docker-based, pinned-toolchain build eliminates host-OS variance.

## Scope
- Add a `build/Dockerfile` (or extend the existing build image) that pins the Go toolchain, `make`, and any license-generation tooling.
- Provide a `make` target (e.g. `make docker-build`, `make license-check`) that runs the build inside the container.
- Ensure the license-generation step produces **byte-identical** output regardless of host OS:
- Normalize line endings (`LF`).
- Stable sort order for 3rd-party entries.
- Deterministic timestamps (e.g., `SOURCE_DATE_EPOCH`).
- Wire the Docker build into CI so contributors can reproduce CI locally with one command.
- Document usage in `CONTRIBUTING.md` / `README.md` / `Makefile` header comments.

## Tasks
1. **Research** — survey current license-generation pipeline (scripts under `scripts/`, `Makefile` targets, any existing image); identify which steps contribute to non-determinism.
2. **Design** — pick the base image strategy (buildx, distroless, alpine, debian-slim), toolchain pinning, and caching (BuildKit cache mounts).
3. **PoC** — implement:
- `build/Dockerfile`
- `Makefile` target(s) wrapping `docker buildx build` / `docker run`
- CI workflow update
4. **Tests** — verify byte-identical output across three OSes (or at minimum: Linux host vs. macOS host vs. Windows host via CI matrix). Add a CI guard that fails if generated license files drift.
5. **Docs** — update `CONTRIBUTING.md` / `README.md`.

## Acceptance Criteria
- `make docker-license-check` (or equivalent) produces the same output on Linux/macOS/Windows.
- CI uses the Docker-based build for license generation.
- No host-OS-specific instructions in `CONTRIBUTING.md` beyond "have Docker".
- All existing `make` targets still work natively for quick dev loops (Docker is the canonical path, not the only one).

## Related
- Parent chore tracking issue: #13995