image(broker): mirror server's git-cli + musl toolchain setup

server.Dockerfile already has CARGO_NET_GIT_FETCH_WITH_CLI=true plus git,
cmake, make, pkg-config, and the musl-gcc CC vars needed for the clawhdf5
git dep (libgit2 fails against Gitea smart-HTTP with "invalid packet line";
the git CLI works fine). broker.Dockerfile was missing all of it, so the
CI publish job failed at the very first `cargo build --release -p
clawmates-broker` inside the Docker builder. Copy the pattern.

images/broker.Dockerfile

@@ -2,21 +2,29 @@
 # Shares the builder pattern with the server image; ships ONLY the broker
 # binary.
 FROM rust:1-bookworm AS builder
+# git + cmake are needed for the clawhdf5 git dependency (fetched via the git
+# CLI — libgit2 chokes on Gitea smart-HTTP) and its zlib-ng C build (cmake).
 RUN case "$(uname -m)" in \
       aarch64) echo aarch64-unknown-linux-musl > /rust-target ;; \
       *)       echo x86_64-unknown-linux-musl > /rust-target ;; \
     esac \
     && rustup target add "$(cat /rust-target)" \
-    && apt-get update && apt-get install -y --no-install-recommends musl-tools \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends musl-tools git cmake make pkg-config \
     && rm -rf /var/lib/apt/lists/*
 WORKDIR /src
-COPY Cargo.toml rust-toolchain.toml ./
+COPY Cargo.toml Cargo.lock rust-toolchain.toml ./
 COPY crates ./crates
 COPY tools ./tools
 COPY images/seccomp ./images/seccomp
 COPY migrations ./migrations
 COPY .sqlx ./.sqlx
 ENV SQLX_OFFLINE=true
+# Fetch git deps with the system git (libgit2 fails against Gitea smart-HTTP);
+# build the zlib-ng C dep with the musl cross compiler for the static target.
+ENV CARGO_NET_GIT_FETCH_WITH_CLI=true \
+    CC_x86_64_unknown_linux_musl=musl-gcc \
+    CC_aarch64_unknown_linux_musl=musl-gcc
 RUN cargo build --release --target "$(cat /rust-target)" -p clawmates-broker \
     && cp "target/$(cat /rust-target)/release/clawmates-broker" /clawmates-broker