fix: close the three residual risks from the 2026-09-06 merges

Each of the three was merged on evidence I could not reach myself. This
replaces that trust with a test that runs on every platform, on every CI run.

1. Windows lock (#1261). The no-sentinel fix was unverifiable on POSIX —
   msvcrt is None, so the branch never executes and a regression would be
   invisible to Linux and macOS CI. tests/test_windows_lock_no_sentinel.py
   swaps the module-level fcntl/msvcrt handles for stubs and drives the
   Windows branch anywhere, asserting behaviour (an empty file stays empty,
   the first ledger append succeeds and verify_chain passes) rather than
   'was locking() called'. Restoring the sentinel in all three lock sites
   fails 3 of the 4 tests, including the first-append regression itself.

2. Dividend cash column (#1356). A dividend row has no quantity and no price,
   so 'amount or qty * price' collapses to 0.0 when the export books the
   payout under a cash-movement heading instead of the fill column. That is a
   silent zero — the shape #1207 item 15 is about. Dividend rows now also try
   发生金额 / 资金发生额 / 红利金额 / 实发金额 / 税后金额 and Futu's net-amount
   columns, across all four parsers; anything still zero is counted into a new
   dividend_rows_missing_cash profile field so the caller can SEE that the
   journal was read but the money was not.

3. Docker action majors (#1359). The v4/v6/v7 bump had never executed in this
   repository: docker-build.yml is workflow_dispatch only, total_runs=0. Every
   input the workflow passes was checked against each new major's action.yml
   at the pinned SHA (13 inputs, all present; the two setup actions take none).
   A validate-build job now runs the SAME pins with push: false on any change
   to the Dockerfile, this workflow, or pyproject, and the publish job is
   gated to workflow_dispatch so the new triggers cannot publish an image.
   That gate is one 'if:' line, so it is pinned too — removing it, flipping
   validate-build to push: true, or unpinning an action each fail a test.

The file comment claiming these majors were 'a deliberate, separately testable
bump, not a drive-by change here' contradicted the file after #1359 and is
replaced by what is actually true now.

.github/workflows/docker-build.yml

@@ -1,8 +1,15 @@
 name: Build and Push Docker Image
 
 # Actions are pinned to immutable commit SHAs, matching every other workflow in
-# this repository. Newer majors exist for the docker/* actions (v4/v6/v7); those
-# are a deliberate, separately testable bump, not a drive-by change here.
+# this repository. The docker/* actions were moved to v4/v6/v7 in #1359; every
+# input this workflow passes was checked against each new major's action.yml at
+# the pinned SHA before the bump landed.
+#
+# The publish job runs on workflow_dispatch only, so it is exercised roughly
+# once per release. That is why `validate-build` below exists: a bad pin or a
+# broken Dockerfile would otherwise be discovered by whoever is mid-release,
+# not by CI. It runs the SAME four actions with `push: false`, on every change
+# to the Dockerfile, this workflow, or the packaging metadata.
 
 on:
   workflow_dispatch:
@@ -11,6 +18,19 @@ on:
         description: 'Image tag (e.g., v1.0.0, latest)'
         required: true
         default: 'latest'
+  pull_request:
+    paths:
+      - 'Dockerfile'
+      - '.dockerignore'
+      - '.github/workflows/docker-build.yml'
+      - 'pyproject.toml'
+  push:
+    branches: [main]
+    paths:
+      - 'Dockerfile'
+      - '.dockerignore'
+      - '.github/workflows/docker-build.yml'
+      - 'pyproject.toml'
 
 env:
   GHCR_REGISTRY: ghcr.io
@@ -19,7 +39,51 @@ env:
   DOCKERHUB_IMAGE_NAME: ${{ secrets.DOCKERHUB_USERNAME }}/${{ github.event.repository.name }}
 
 jobs:
+  # Exercises the pinned docker/* actions and the Dockerfile without pushing
+  # anything. Single platform on purpose: this is a "does it still build and do
+  # the actions still accept these inputs" check, not a release build, and
+  # emulating arm64 here would triple the runtime for no extra signal.
+  validate-build:
+    if: github.event_name != 'workflow_dispatch'
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+
+      - name: Extract metadata
+        id: meta-validate
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        with:
+          images: ${{ env.GHCR_REGISTRY }}/${{ env.GHCR_IMAGE_NAME }}
+          tags: |
+            type=raw,value=ci-validate
+
+      - name: Build without pushing
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          file: Dockerfile
+          platforms: linux/amd64
+          push: false
+          tags: ${{ steps.meta-validate.outputs.tags }}
+          labels: ${{ steps.meta-validate.outputs.labels }}
+          # Deliberately no GitHub Actions cache here. `type=gha` export needs
+          # a wider token than this job's `contents: read`, and a cache
+          # misconfiguration failing the run would make the check a source of
+          # false alarms rather than a guard. This job is path-filtered and
+          # rare; a cold build is the cheaper trade.
+
   build-and-push:
+    if: github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-24.04
     permissions:
       contents: read