ci(docker): run the image build check on PRs that touch crate sources

The pull_request paths filter listed only Dockerfile/entrypoint/.dockerignore/Cargo.{toml,lock}/workflow/crate manifests, so a PR changing only Rust sources never triggered the build-only check — and the Dockerfile's stub-plus-touch layering is exactly the thing that breaks against source structure it has never seen (a new crate directory, a build script). Such PRs now get the check before master/tag reveals the problem; crates/**/Cargo.toml is subsumed by crates/**.

.github/workflows/docker.yml

@@ -21,7 +21,10 @@ on:
       - Cargo.toml
       - Cargo.lock
       - .github/workflows/docker.yml
-      - 'crates/**/Cargo.toml'
+      # Any crate source, not just manifests: the stub/touch layering only
+      # breaks against real source structure, which a manifest-only PR never
+      # exercises.
+      - 'crates/**'
 
 env:
   APP_NAME: telegram-twitter-media-bot