ci(docker): self-contained build on self-hosted runners

The shared reusable workflow (hanzoai/.github docker-build.yml@main) fails graph
validation for EVERY caller right now (org-wide startup_failure, 0 jobs created),
so id never built via CI (0.1.x images were pushed manually). Build the amd64
image directly on our self-hosted runners instead — no shared-infra dependency.
Tags: sha-<short> + package.json version.

.github/workflows/docker.yml

@@ -1,4 +1,8 @@
 name: Docker
+# Self-contained build on Hanzo self-hosted runners. The shared reusable
+# workflow (hanzoai/.github docker-build.yml@main) is currently failing graph
+# validation for every caller (org-wide startup_failure), so this repo builds
+# its own image directly. Cluster nodes are linux/amd64 → build that arch.
 on:
   workflow_dispatch:
   push:
@@ -9,11 +13,36 @@ permissions:
   packages: write
 jobs:
   docker:
-    uses: hanzoai/.github/.github/workflows/docker-build.yml@main
-    with:
-      image: ghcr.io/hanzoai/id
-      pre-build-command: |
-        corepack enable
-        pnpm install --frozen-lockfile
-        pnpm build
-    secrets: inherit
+    runs-on: [self-hosted, linux, amd64]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Compute tags
+        id: tags
+        run: |
+          SHA="sha-$(git rev-parse --short HEAD)"
+          VER="$(node -p "require('./package.json').version")"
+          echo "sha=$SHA" >> "$GITHUB_OUTPUT"
+          echo "ver=$VER" >> "$GITHUB_OUTPUT"
+          echo "Tags: $SHA, $VER"
+
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Login to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push (linux/amd64)
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64
+          push: true
+          tags: |
+            ghcr.io/hanzoai/id:${{ steps.tags.outputs.sha }}
+            ghcr.io/hanzoai/id:${{ steps.tags.outputs.ver }}
+          cache-from: type=gha,scope=hanzoai-id
+          cache-to: type=gha,scope=hanzoai-id,mode=max