CI image builds break on Alpine docker-cli -rN bumps

Problem

The four runtime Dockerfiles in `engine/` pin `docker-cli` to an exact Alpine package revision:

• `engine/Dockerfile.ci-checker`
• `engine/Dockerfile.dblab-cli`
• `engine/Dockerfile.dblab-server`
• `engine/Dockerfile.dblab-server-debug`

All four currently use `apk add --no-cache ... docker-cli=29.1.3-r4 ...`. Alpine's community repo only keeps the latest `-rN` build of a given upstream version; when the package is rebuilt (CVE backport, newer toolchain) the previous revision disappears from the index.

That happened around 2026-05-18, when `docker-cli-29.1.3-r5` replaced `-r4`. Combined with the preceding `apk upgrade --no-cache`, the install step is now unsatisfiable:

``` ERROR: unable to select packages: docker-cli-29.1.3-r5: breaks: world[docker-cli=29.1.3-r4] ```

Every MR pipeline rebuilding these images fails until the pin is bumped (!1148 (merged)/!1149 (merged)/!1150 (merged)/!1151 (merged) all hit this).

History

• Strict pin introduced 2026-05-07 in commit f111b75b (MR !1144 (merged)) when the base was switched from `docker:29.4.1` to plain `alpine:3.23`.
• Last green master pipeline: 2026-05-18 03:07 UTC.
• First red: MR !1148 (merged) at 2026-05-18 10:12 UTC — so the `-r4` revision lasted ~11 days.

Fix

Loosen the pin to apk's fuzzy operator: `docker-cli~29.1.3`. This accepts any `-rN` rebuild of the same upstream version, so routine Alpine CVE rebuilds no longer break CI, while the explicit upstream version remains as audit/intent signal. Tracked in the accompanying MR.

This is a defensible compromise vs the alternatives:

• Drop the pin entirely — simpler, but loses the explicit upstream-version statement.
• Snapshot/mirror Alpine repos — proper reproducibility, but disproportionate infra work for this need.

Note: `~29.1.3` will still need a manual bump when Alpine ships `29.1.4` or moves past it; this is a less-frequent failure mode of the same class.