Reorder Dockerfile builder: install deps before copying src

[Chr96er]

What

Move COPY src ./src in the builder stage to after the uv pip install -r requirements.txt step.

Why

The builder currently copies src/ before the dependency install:

COPY pyproject.toml requirements.txt README.md MANIFEST.in ./
COPY src ./src                                    # ← invalidates the next layer on any src edit
RUN ... uv pip install --prefix=/install -r requirements.txt && \
        uv pip install --prefix=/install --no-deps .

Docker layer caching is sequential, so editing any file under src/ invalidates the requirements.txt install layer — every rebuild re-resolves and reinstalls apache-beam[gcp] and its transitives, even though dependencies didn't change.

After the reorder, a source-only change re-runs only the package-install layer (--no-deps . + .), turning cached source rebuilds from ~1–2 min into seconds. The deps layer is keyed on pyproject.toml / requirements.txt only. This is the same layering anchorages_pipeline already uses (its Dockerfile even documents it).

Safety

No behavioural change to the resulting image — identical install commands, only the layer ordering changed. The --no-deps . install still has everything it needs (pyproject.toml, README.md, MANIFEST.in copied earlier; src/ copied just before it).

Context

This speeds up dit's auto-built worker images (it builds this Dockerfile's prod target per unreviewed run); with the current layering those rebuilds pay the full deps cost on every source change.