dockerfile-slim-advisor — catch Dockerfile bloat and cache-busting before the build does

hadolint checks style; this focuses on size and build-cache: layer ordering that busts cache, missing multi-stage, apt lists not cleaned, copying the whole context before deps.