2.2.2 — yq/tomlq in ci image

Bakes python3-yq (kislyuk variant) into the ci image so consumers
of dunn.dev/reference can run contracts whose check.sh uses the
check_toml_key primitive.

Image grows ~25 MB. No template changes; reference-check@2.2.2 and
all other components consume ci:2.2.2 the same way they did at 2.2.1.