2.2.3 — fix ci image build that failed under 2.2.2

Same intent as 2.2.2 (bake yq/tomlq into the ci image for consumers
of dunn.dev/reference that exercise check_toml_key). The 2.2.2
attempt used a non-existent Fedora 42 package and the image build
failed. 2.2.3 switches to pip install yq with PEP-668 override.