chore(ci): keep the Vercel AI image in step with the service Dockerfile

[Fluory]

Problem

services/ai/Dockerfile.vercel (showcase, Vercel container route) says "Same build as ./Dockerfile – keep both in sync", but nothing checks it. The only proof of the Vercel image is the Vercel build check (build, not runtime). Found in the fresh review of #68.

Acceptance criteria

• CI builds services/ai/Dockerfile.vercel on changes under services/ai/ and starts it with PORT=8080; GET /healthz answers 200
• Or, if a second image build is too slow for CI: a check that fails when the two Dockerfiles differ outside the documented lines (model prefetch, PORT)
• The decision between the two is stated in the PR

Not part of this task

• Merging the two Dockerfiles

Security/Privacy affected?

No.

[Fluory]

Claimed by @Fluory on branch claude/ci-dockerfile-drift-79 (Freigabe des Orchestrators 2026-09-28: „mach dann weiter“).