fix(docker): 预装 binaryen 避免 dx 运行时下载 wasm-opt 失败

dx build @client --release 默认启用 wasm-opt 优化 WASM bundle。
镜像缺失 wasm-opt 时,dx 内部会从 GitHub Releases 动态下载,
而这个下载不受 Dockerfile 的 GH_PROXY 控制(GH_PROXY 只覆盖
dx/tailwindcss 那两个显式 curl 调用)。

后果:容器内 80 分钟超时后报
  Failed to create wasm-opt instance
  error decoding response body
  error reading a body from connection
  stream error received: unspecific protocol error detected

apt 装 binaryen 把 wasm-opt 放到 /usr/bin,dx 直接复用 PATH 里
现成的二进制,不再触发网络下载。仅影响 builder 阶段,
不进 runtime scratch 镜像。

Dockerfile

@@ -36,6 +36,12 @@ RUN sed -i \
 # Install system build tooling. Native dependencies are needed for:
 #   - musl-tools: linker for x86_64-unknown-linux-musl
 #   - cmake/clang/nasm/libssl-dev: libwebp (zenwebp), ring, syntect
+#   - binaryen: provides `wasm-opt` on PATH so dx's release client build
+#     uses the local binary instead of fetching one from GitHub Releases.
+#     dx's internal wasm-opt download ignores GH_PROXY (only the explicit
+#     curl calls for dx/tailwindcss honor it), so without this the build
+#     hangs ~80 min then fails with "stream error received: unspecific
+#     protocol error detected" trying to fetch wasm-opt mid-build.
 #   - curl/gnupg/ca-certificates: download tooling
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
@@ -46,6 +52,7 @@ RUN apt-get update \
         pkg-config \
         libssl-dev \
         musl-tools \
+        binaryen \
         ca-certificates \
         curl \
         gnupg \