ci: run clippy + cargo test inside Dockerfile builder

The previous approach (`docker run -v $(pwd)/rust/prop_grid_rs:/src`)
fails under act_runner because the runner container's pwd isn't a path
the host docker daemon can see — clippy installed, then cargo couldn't
find Cargo.toml.

Move the lint + test gate into the Dockerfile builder stage so the
build context ships over the socket the normal way. If clippy warns or
a test regresses, the image build fails and nothing is pushed.

.forgejo/workflows/build-grid-rs.yaml

@@ -59,22 +59,6 @@ jobs:
           echo "Docker daemon never became reachable" >&2
           exit 1
 
-      # Gate the image build on a clean test run so a push that regresses
-      # the scorer or breaks clippy never produces an image. The stock
-      # `rust:1.94-trixie` image doesn't ship clippy, so add it before
-      # running.
-      - name: cargo clippy + test
-        run: |
-          docker run --rm \
-            -v "$(pwd)/rust/prop_grid_rs":/src \
-            -w /src \
-            rust:1.94-trixie \
-            sh -euc '
-              rustup component add clippy
-              cargo clippy --all-targets -- -D warnings
-              cargo test
-            '
-
       - name: Generate image tag
         id: tag
         run: |

rust/prop_grid_rs/Dockerfile

@@ -16,7 +16,14 @@ RUN mkdir -p src src/bin \
  && rm -rf src
 
 COPY src ./src
-RUN cargo build --release --bin worker
+COPY tests ./tests
+
+# Lint + test gate the image build — a regressed scorer or a clippy
+# warning never produces a pushable image.
+RUN rustup component add clippy \
+ && cargo clippy --all-targets -- -D warnings \
+ && cargo test --release \
+ && cargo build --release --bin worker
 
 # Runtime image: slim debian plus wgrib2. libexpat/libjasper pulled in
 # transitively by wgrib2 for PNG/JPEG2000 GRIB2 decompression.