feat(docker): ship ripgrep in the image

The coding agents Fusion drives reach for `rg` as their primary search tool. It
was absent from the image, so inside a container they silently fall back to
slower or partial search while working fine on a developer machine that has it
installed. Operator asked for it by default.

Installed alongside git and ca-certificates in the runner stage, and covered by
the same runner-stage guard so it cannot quietly drop out again.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/__tests__/dockerfile-workspace-manifests.test.mjs

@@ -126,4 +126,9 @@ test("runner stage installs ca-certificates alongside git", () => {
     /\bca-certificates\b/,
     "runner stage must install ca-certificates — git cannot verify HTTPS remotes without a system CA bundle",
   );
+  assert.match(
+    aptInstall,
+    /\bripgrep\b/,
+    "runner stage must install ripgrep — the coding agents Fusion drives use `rg` as their primary search tool",
+  );
 });