fix: use lockfile for reproducible builds and correct Dockerfile port comments (#365)

* fix: use lockfile for reproducible builds and correct port comments in Dockerfile

- Use `uv sync --frozen --no-dev` instead of `uv pip install -r pyproject.toml`
  so builds resolve dependencies from uv.lock deterministically (CONT-06)
- Require uv.lock (drop glob wildcard) since frozen sync needs it
- Fix port comments to match AgentCore Runtime service contract:
  8080=HTTP, 8000=MCP, 9000=A2A (CONT-07)

* fix: use two-step uv sync for reproducible Docker builds

The single `uv sync` before COPY failed because hatchling needs
README.md (not yet copied). Split into two steps:
1. `uv sync --frozen --no-dev --no-install-project` — deps only
2. `uv sync --frozen --no-dev` — project install after full COPY

Also move `USER bedrock_agentcore` after both syncs so the venv
created by root remains writable for the project install step.

Author: tejaskash

src/assets/container/python/Dockerfile

@@ -8,17 +8,21 @@ ENV UV_SYSTEM_PYTHON=1 \
     PYTHONUNBUFFERED=1 \
     DOCKER_CONTAINER=1
 
-COPY pyproject.toml uv.lock* ./
-RUN uv pip install -r pyproject.toml
-
 RUN useradd -m -u 1000 bedrock_agentcore
-USER bedrock_agentcore
+
+COPY pyproject.toml uv.lock ./
+RUN uv sync --frozen --no-dev --no-install-project
 
 COPY --chown=bedrock_agentcore:bedrock_agentcore . .
+RUN uv sync --frozen --no-dev
+
+USER bedrock_agentcore
 
-# 8080: AgentCore runtime endpoint
-# 8000: Local dev server (uvicorn)
-# 9000: OpenTelemetry collector
+# AgentCore Runtime service contract ports
+# https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-service-contract.html
+# 8080: HTTP Mode
+# 8000: MCP Mode
+# 9000: A2A Mode
 EXPOSE 8080 8000 9000
 
 CMD ["opentelemetry-instrument", "python", "-m", "{{entrypoint}}"]