ci: verify Cloudflare memory preflight

[nicklasl]

Summary

• Run the built-Worker memory preflight in a dedicated CI step using the deployer's pinned runtime.
• Wrap the checked-in resolver state in a test CDN envelope for the integration test.
• Keep the default Docker build independent of this check.

Validation

• git diff --check
• CI YAML parsed with Ruby Psych
• Fixture decoded with protoc --decode_raw
• Full Docker build unavailable locally because the Docker daemon is inaccessible