fix(ci): pass tool versions via build-args to avoid GitHub API rate limiting

[hrygo]

Summary

• Pass GitHub CLI, yq, and lazygit versions as build arguments from CI to avoid rate limiting during Docker build
• Add fetch tool versions step in CI prepare phase using GH_TOKEN authentication
• Maintain backward compatibility: local builds still work by falling back to dynamic version fetch

Problem

CI was failing with exit code 22 when Docker tried to fetch latest tool versions via GitHub API without authentication. This is because unauthenticated requests are limited to 60/hour, and the 3 API calls during build could exceed this limit.

Solution

• Move version fetching to CI prepare phase where GH_TOKEN is available
• Pass versions as build-args to docker build-push-action
• Update Dockerfile to use passed versions or fallback to dynamic fetch

Test plan

• Trigger CI build and verify it completes successfully
• Verify all three tools (gh, yq, lazygit) are installed with correct versions

🤖 Generated with Claude Code