build(images): move the two Dockerfile build pins with the lock

cde3834 took build 1.6.0 in uv.lock and publish-pypi.yml but stopped
there, and test_demo_image_build_pins.py failed on main exactly as
designed: Dockerfile.api and deploy/hf-space/Dockerfile pin
`build==<the version uv.lock resolves>` because `python -m build
--no-isolation` makes that pin the builder that actually runs. A lock
bump that leaves them behind means the image builds its wheel with a
different -- and now yanked -- builder than CI resolves.

The miss was mine and mechanical: I grepped for the pin under .github/,
scripts/ and docs/ only, so the two Dockerfiles never showed up. The
ratchet is the reason this cost one red run instead of a divergence
nobody noticed.

Verified: test_demo_image_build_pins.py and test_publish_workflows.py
pass (10 passed), and all three tests that read uv.lock pass (32 passed).
No `build==1.5.1` remains anywhere in the tree.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018ybRVCaL1Lyd9d5kFTndh3

Author: JuliaEdom

Dockerfile.api

@@ -21,7 +21,7 @@ COPY packaging /build/packaging
 # a reproducibility input for the artifact: with --no-isolation its only job is
 # installing these two pinned distributions.
 RUN pip install --no-cache-dir --upgrade pip \
-    && pip install --no-cache-dir build==1.5.1 hatchling==1.31.0 \
+    && pip install --no-cache-dir build==1.6.0 hatchling==1.31.0 \
     && python -m build --wheel --no-isolation --outdir /tmp/dist
 
 FROM python:3.11-slim@sha256:9c900dea9e8fb7e16277c179b555cc72d29a352dbc33cff48ad5a0412fd5bfc7

deploy/hf-space/Dockerfile

@@ -32,7 +32,7 @@ WORKDIR /src
 # Mirrors Dockerfile.api: pinned build backend, and --no-isolation so the pin is
 # what builds the wheel instead of a fresh PyPI download inside build's venv.
 RUN pip install --no-cache-dir --upgrade pip \
-    && pip install --no-cache-dir build==1.5.1 hatchling==1.31.0 \
+    && pip install --no-cache-dir build==1.6.0 hatchling==1.31.0 \
     && python -m build --wheel --no-isolation --outdir /tmp/dist
 
 FROM python:3.11-slim@sha256:9c900dea9e8fb7e16277c179b555cc72d29a352dbc33cff48ad5a0412fd5bfc7