fix(docker): keep apt cache from filling /var disk during build

The cdo install pulls ~1 GB of transitive deps (netCDF/HDF5/ecCodes/
Fortran) and was exhausting CI's /var/cache/apt partition. Two fixes:

- `APT::Keep-Downloaded-Packages=false` deletes each .deb immediately
  after it's extracted, so the archive cache doesn't retain every
  downloaded package through the end of the install.

- Split cdo into its own RUN layer so the base runtime deps finish
  installing and clean before cdo's cache starts growing.

Dockerfile

@@ -142,11 +142,25 @@ FROM ${RUNNER_IMAGE} AS final
 # compile cache. Read at runtime by Microwaveprop.Application.build_timestamp/0.
 ARG BUILD_TIMESTAMP=unknown
 
+# Base runtime deps, without cdo. `APT::Keep-Downloaded-Packages=false`
+# deletes each .deb immediately after install so apt's archive cache
+# doesn't pile up and OOM the /var/cache/apt disk partition the CI
+# builder runs on.
 RUN apt-get update \
-  && apt-get install -y --no-install-recommends \
+  && apt-get -o APT::Keep-Downloaded-Packages=false install -y --no-install-recommends \
      libstdc++6 openssl libncurses6 locales ca-certificates snmp \
-     libgfortran5 libaec0 zlib1g libpng16-16t64 libopenjp2-7 cdo \
-  && rm -rf /var/lib/apt/lists/*
+     libgfortran5 libaec0 zlib1g libpng16-16t64 libopenjp2-7 \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*.deb
+
+# cdo is ~1 GB of transitive deps (netCDF, HDF5, ecCodes, Fortran
+# runtime). Splitting into its own RUN layer means the base deps above
+# are already extracted + pruned before the cdo cache starts filling,
+# which is what kept the image under the 2 GB CI disk cap.
+RUN apt-get update \
+  && apt-get -o APT::Keep-Downloaded-Packages=false install -y --no-install-recommends cdo \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*.deb
 
 RUN sed -i '/en_US.UTF-8/s/^# //g' /etc/locale.gen && locale-gen