docs(Dockerfile): record the frozen-graph gap where the gap is

[y1o1]

Summary

The builder stage's pnpm install resolves the generated instance's transitive
graph fresh, at image-build time. release.lock.frozen-graph forbids
exactly that: the published artifact's dependency graph was then never the graph
anything tested, and it can differ between two builds of one source.

--dplaax-module-ref now pins the git deps to a commit (enforced since #14),
but their own npm dependencies are still resolved in this stage.

This was tracked in a temporary publication runbook that is about to be
deleted. A backlog entry outliving its file is how a known gap becomes an
unknown one — so it moves to the line it describes.

What the note says beyond "TODO"

• Why it is not closable here. pnpm --lockfile-only in the gen stage just
  moves the fresh resolution a few lines earlier, still inside the release
  build. The fix generates the lockfile before the image build, proves it with
  --frozen-lockfile + the consumer smoke, then hands that exact instance and
  lockfile to docker build — a change to the publish workflow, not this stage.
• Why it waits for the next version cut. That is when publish-images
  actually runs, so a mistake in the restructure surfaces immediately instead of
  sitting in a path nothing exercises. Landing it earlier would repeat
  provin.oss's quickstart §2f: documented, unexecuted, and wrong.

Test plan

Comment only — no build instruction changed. CI on this PR is the check.