docker: fail the image build when requirements.txt is not satisfied

[Rockdu]

What

• docker/check_requirements.py + a final RUN in the Dockerfile: after all installs, verify every requirements.txt entry is present at a satisfying version (handles extras, git URLs, and platform markers), then smoke import miles. A stomped or missing requirement now fails the build instead of shipping a broken pr-N/latest.
• Path filters (docker-paths in pr-test.yml, push paths in docker-build.yml) also watch the checker script.

Why

• The image installs several components with --no-deps (sglang, wheels) after pip install -r requirements.txt, so a requirement can be silently downgraded or removed; nothing validated the final state. Whole-env pip check is not usable as a gate — the --no-deps installs make it noisy by design (15+ pre-existing complaints in the current image).

Validation

• Checker run inside the live rockdu/miles_diffusion:latest: current requirements pass; a seeded version mismatch and a missing package both fail with exit 1 and a per-entry report.

🤖 Generated with Claude Code

[Rockdu]

Closing: the actual need (docker PRs build their own image and test inside it) already exists via docker-paths/docker-build/resolve-ci-image; this extra build-time validation isn't worth the surface.