Release binaries follow-ups: Docker layer caching, recompile-on-commit note, TLS probe matching #373

Follow-ups from the final automated review of #369 (e5d42d6). None of them affects correctness.

• Docker layer caching. build.rs and src/build_info/resolve.rs are copied before the dependency-only build, so editing either rebuilds every dependency in the Docker image. Restructure so the dependency layer depends only on Cargo.toml and Cargo.lock.
• Document recompile-on-commit in AGENTS.md. build.rs watches logs/HEAD and the ref directory, so every commit or checkout recompiles the crate. This is intended (the embedded commit must follow HEAD), but it should be stated.
• TLS probe robustness. scripts/release/tls-probe.sh matches the Chroma client's error wording. Expose the reqwest error cause chain, or a typed error kind, so the negative probe can match on certificate verification directly.

🤖 Generated with Claude Code