Rebuild when Dockerfile path changes

[techulus-agent]

Summary

• trigger a GitHub source build when TECHULUS_DOCKERFILE_PATH is added, updated, or removed
• resolve custom Dockerfiles relative to the configured service root and pass the directory/filename explicitly to BuildKit
• reject missing, absolute, escaping, directory, and symlink-escaping Dockerfile paths
• keep the platform setting out of application build secrets

Verification

• go test ./... in agent
• pnpm test in web (133 tests)
• Biome checks on touched web files
• git diff --check
• final Odin review: approved with no blockers

Basecamp: https://app.basecamp.com/5890597/buckets/47439993/todos/10109181327

[github-actions]

React Doctor found no new issues. 🎉

_{Reviewed by React Doctor for commit a130910.}