feat(tools): one-shot install missing runtime deps for skills

Added in this image:
- pandoc 2.17.1          universal doc converter
- yq v4.53.2              YAML CLI query
- sqlite3 3.40.1          local cache storage
- codex-cli 0.124.0       OpenAI Codex CLI (for codex:codex-rescue agent)
- pip-audit               CVE scanner
- python-docx, pypdf, openpyxl, python-pptx, Pillow, pandas, markdown
                          (for potential anthropic-skills docx/pdf/xlsx/pptx)

Skipped:
- omc CLI: macOS-brew-only, plugin-level skills work without the CLI
- chrome-for-testing: ARM64 unsupported, we use system chromium

Verified all tools load in fresh container.

Dockerfile

@@ -69,7 +69,20 @@ ENV AGENT_BROWSER_CHROMIUM_PATH=/usr/bin/chromium \
     PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium
 
 RUN pip install --break-system-packages --no-cache-dir \
-      uv ruff black pytest pytest-asyncio httpx
+      uv ruff black pytest pytest-asyncio httpx \
+      python-docx pypdf openpyxl python-pptx Pillow pandas markdown \
+      pip-audit
+
+# pandoc（通用文档转换）+ yq（YAML 查询）+ sqlite3（本地缓存用）
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      pandoc sqlite3 \
+    && curl -fsSL https://github.com/mikefarah/yq/releases/latest/download/yq_linux_${TARGETARCH} \
+         -o /usr/local/bin/yq \
+    && chmod +x /usr/local/bin/yq \
+    && rm -rf /var/lib/apt/lists/*
+
+# OpenAI Codex CLI（给 codex:codex-rescue agent 用）
+RUN npm install -g @openai/codex || echo "codex 装失败（可能需要 auth，先略过）"
 
 RUN git config --system --add safe.directory '*' \
     && git config --system pull.rebase false \