fix(build): configure Docker pip mirrors with locked fallback [skip ci]

Dockerfile

@@ -26,13 +26,15 @@ RUN --mount=type=cache,id=frameflow-bookworm-apt-${TARGETARCH},target=/var/cache
     && mkdir -p /data/images /data/generated /data/cache /config \
     && chown -R 10333:10333 /data /config
 COPY requirements.lock ./
+COPY scripts/ci-install.py /build-tools/install.py
+ARG DOCKER_PIP_INDEX_URL=https://mirrors.tuna.tsinghua.edu.cn/pypi/web/simple
+ARG DOCKER_PIP_FALLBACK_INDEX_URL=https://pypi.org/simple
 RUN --mount=type=cache,id=frameflow-pip-py314-${TARGETARCH},target=/root/.cache/pip,sharing=locked \
     --mount=type=bind,source=build-cache/wheels,target=/build-wheels,readonly \
     if [ -f /build-wheels/SHA256SUMS ]; then \
       (cd /build-wheels && sha256sum -c SHA256SUMS) \
       && pip install --no-index --find-links=/build-wheels -r requirements.lock; \
-    else python -c "import os; from urllib.parse import urlsplit; print('Docker build pip index host:', urlsplit(os.getenv('PIP_INDEX_URL', 'https://pypi.org/simple')).hostname, flush=True)" \
-      && pip install -r requirements.lock; fi
+    else python /build-tools/install.py --locked; fi
 COPY pigway_frame_flow ./pigway_frame_flow
 COPY vendor ./vendor
 ARG BUILD_COMMIT=development