feat: reusable workflow for Docker image build and smoke test

[MarkCesium]

Summary

Lint + tests still don't catch broken Dockerfiles or wrong CMD wiring. A smoke test catches those before they hit prod.

Changes

• .github/workflows/docker-smoke.yml.
• Builds the service's dev stage, tags it, pulls infra at main, replaces the service image in compose, runs make dev, waits up to 120s for healthcheck, tears down.
• Fails if healthcheck never passes.

Verification

• Intentionally break CMD in a service Dockerfile — CI fails on smoke, not on lint.