fix: bake CI deps into Docker image, fix chunk use_metadata OOB

- Build and push fastsync-ci:v8 with lcov, valgrind, clang baked in
- Remove all apt-get install steps from CI (v8 has them pre-installed)
- Fix chunk.c use_metadata=true OOB: add remaining_size guard before
  metadata_from_buf reads past the buffer. The bug allowed network-facing
  chunk_deserialize to heap-buffer-overflow on crafted inputs.
- Also guard against unsigned underflow on remaining_size - sizeof(int)

Dockerfile

@@ -1,7 +1,8 @@
 FROM ubuntu:24.04
 RUN apt-get update && apt-get install -y --no-install-recommends \
     gcc g++ make libc6-dev cmake libzstd-dev libssl-dev git ca-certificates curl cppcheck clang-format \
-    python3 python3-pip python3-venv openssl openssh-client lcov valgrind && \
+    python3 python3-pip python3-venv openssl openssh-client \
+    lcov valgrind clang libclang-rt-18-dev && \
     pip3 install --break-system-packages pytest && \
     curl -fsSL https://deb.nodesource.com/setup_20.x | bash - && \
     apt-get install -y --no-install-recommends nodejs && \