fix(ci): authenticate tramiton fetch in dashboard + mcp image builds

The main deploy after #145 failed on Deploy Dashboard and Deploy MCP: because
compliance-agent (a workspace member) depends on the private tramiton-core git
repo, cargo/dx must resolve it even when building the dashboard or mcp — and
those Dockerfiles had no git auth ("unknown SSH host key"). Deploy Agent (fixed
in #143) succeeded.

Apply the same BuildKit-secret fix to Dockerfile.dashboard (dx build) and
Dockerfile.mcp (cargo build), and pass the secret in the deploy-dashboard and
deploy-mcp jobs. Dockerfile.docs is node-only and unaffected.

Refs #118.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Dockerfile.dashboard

@@ -7,7 +7,16 @@ ARG DOCS_URL=/docs
 WORKDIR /app
 COPY . .
 ENV DOCS_URL=${DOCS_URL}
-RUN dx build --release --package compliance-dashboard
+# compliance-agent (a workspace member) depends on the private tramiton-core git
+# repo, so the workspace resolve needs it even to build the dashboard.
+# Authenticate the fetch with a PAT passed as a BuildKit secret.
+RUN --mount=type=secret,id=tramiton_token \
+    if [ -s /run/secrets/tramiton_token ]; then \
+      git config --global \
+        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
+        "ssh://git@gitea.meghsakha.com:22222/"; \
+    fi && \
+    CARGO_NET_GIT_FETCH_WITH_CLI=true dx build --release --package compliance-dashboard
 
 FROM debian:bookworm-slim
 RUN apt-get update && apt-get install -y ca-certificates libssl3 && rm -rf /var/lib/apt/lists/*