release: avoid duplicate Docker browser install

[alixander]

Summary

• install only Playwright system dependencies in the root Docker layer
• keep one runtime Chromium installation owned by the non-root D2 user
• remove package-manager metadata from the image layers
• add native amd64 and arm64 image builds that report compressed size and smoke-test CLI, SVG, and PNG output

Why

The v0.8.2 Dockerfile installs Chromium first through npx playwright install --with-deps as root and then through d2 init-playwright as the runtime user, so the browser is downloaded into two separate user caches.

This changes the root step to Playwright's dependency-only installation. The existing non-root initialization remains the single browser installation, preserving PNG export behavior.

The workflow reports measured image sizes rather than enforcing a fixed ceiling.

Measured result

Compressed OCI layers, compared with the currently published v0.8.2 images:

Platform	v0.8.2	This PR	Reduction
linux/amd64	968,956,824 B	625,396,438 B	343,560,386 B (35.46%)
linux/arm64	1,037,552,173 B	656,945,936 B	380,606,237 B (36.68%)

Both native jobs passed D2 version, SVG, and PNG rendering smoke tests.

Validation

• go test ./ci/release/docker -count=1
• go run github.com/rhysd/actionlint/cmd/actionlint@latest .github/workflows/docker-image-smoke.yml
• representative release archives built for linux/amd64 and linux/arm64
• full COLOR=1 CI_FORCE=1 ./make.sh
• native linux/amd64 and linux/arm64 Docker smoke run