fix(docker): always install git in the builder for the sibling installs

Author: vistart

Dockerfile

@@ -38,14 +38,17 @@ ENV PIP_NO_CACHE_DIR=1 \
 
 # psycopg ships binary wheels for amd64 and arm64, the two platforms this
 # project publishes; the remaining ones compile against libpq, which needs a
-# toolchain in the builder stage only -- never the runtime layer.
+# toolchain in the builder stage only -- never the runtime layer. git is always
+# required: the sibling dependencies install from git URLs, and pip shells out
+# to the git binary for those.
 RUN set -eux; \
     case "$TARGETPLATFORM" in \
       linux/amd64 | linux/arm64) \
-        echo "binary wheels expected for $TARGETPLATFORM; skipping build tools" ;; \
-      *) \
-        apt-get update && apt-get install -y --no-install-recommends gcc libpq-dev \
+        apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
         && rm -rf /var/lib/apt/lists/* ;; \
+      *) \
+        apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
+        gcc libpq-dev && rm -rf /var/lib/apt/lists/* ;; \
     esac
 
 RUN python -m venv /opt/venv

docker/README.md

@@ -33,6 +33,22 @@ docker buildx bake --set citracker.platform=linux/amd64 --load
 mcpserver），与 CI 检出的 ref 相同；三者均已公开，构建无需 token。将来发布
 到 PyPI 后，把 `Dockerfile` 里的 git URL 换成版本钉死即可。
 
+### 本地构建的代理分流
+
+在本机（代理走海外节点）构建时，GitHub 要代理、阿里云镜像要直连，用
+`NO_PROXY` 分流，缺一不可：
+
+```powershell
+docker build -t citracker:local `
+  --build-arg HTTP_PROXY=http://host.docker.internal:7897 `
+  --build-arg HTTPS_PROXY=http://host.docker.internal:7897 `
+  --build-arg NO_PROXY=mirrors.aliyun.com,localhost,127.0.0.1,::1 .
+```
+
+`host.docker.internal` 是从构建容器访问宿主机代理的地址（容器内的
+`127.0.0.1` 是它自己）。CI（Actions）网络不受此限，直接构建即可。基础镜像
+已本地打过标签时可完全离线构建。
+
 ## 镜像发布（GitHub Actions）
 
 `images.yml` 由 GitHub Actions 构建并推送到阿里云镜像仓库（ runners 不受