chore: stop shipping uv in the Docker image (#29728)

The Docker image gets about 50 MB smaller on disk (about 20 MB off the pull). uv is only needed to run the requirements install, but it is pip-installed into the image and stays there. It is now bind-mounted from the uv image for that RUN only, pinned to 0.12.10, so the runtime image never contains it. This is the pattern uv's own Docker guide recommends for the case.

Uninstalling uv at the end of the same RUN would also keep it out of the layer; the mount was preferred because it fixes the uv version and the mounted layer is cached by the builder across rebuilds.

pip stays available in the container, so hand-installing optional packages the way requirements.txt describes keeps working; only running uv inside the container goes away. The build now requires BuildKit (the syntax directive alone was a comment to the classic builder, this line makes it mandatory), needs access to ghcr.io next to PyPI, and the uv version is a pin to bump by hand, like the base images.

Part of #29721.

Dockerfile

@@ -144,8 +144,8 @@ COPY --chown=$UID:$GID ./backend/requirements*.txt ./
 # Set UV_LINK_MODE to copy to prevent 0-byte file corruption in QEMU arm64 cross-builds
 ENV UV_LINK_MODE=copy
 
-RUN set -e; \
-    pip3 install --no-cache-dir uv; \
+RUN --mount=from=ghcr.io/astral-sh/uv:0.12.10,source=/uv,target=/bin/uv \
+    set -e; \
     if [ "$USE_SLIM" = "true" ]; then \
     uv pip install --system -r requirements-slim.txt --no-cache-dir; \
     pip3 uninstall -y uv; \