refactor(docker): pre-build install stamp in CI instead of inside the image

CI runs scripts/write_install_stamp.py before  to produce
install-stamp.json with full git provenance. The stamp arrives via the
bulk COPY . . and a late RUN moves it to .hermes_build_info.json —
placed late so a stamp change only re-runs the final layer, not the
expensive build layers above. Local builds without the stamp file
build fine; runtime falls through to 'unknown' source.

.github/workflows/docker.yml

@@ -53,6 +53,9 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - name: Write install stamp
+        run: python3 scripts/write_install_stamp.py --output install-stamp.json
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
@@ -141,6 +144,9 @@ jobs:
       - name: Checkout trusted source
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - name: Write install stamp
+        run: python3 scripts/write_install_stamp.py --output install-stamp.json
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3