fix(ci): docker build met --network=host tegen hangende registry-stappen

De host heeft Docker iptables uitgeschakeld, dus build-containers op
bridge hebben geen outbound internet; 'npm install -g pnpm' in de
builder-stage hing daardoor. Met --network=host krijgt de build wel
registry-toegang. Contract-test vergrendelt de flag.

src/lib/deploy-workflow-contract.test.ts

@@ -24,6 +24,10 @@ describe("deploy job", () => {
 		expect(deployJob).toContain("-t epicnext-cms:latest");
 	});
 
+	it("builds on host network for registry access", () => {
+		expect(deployJob).toContain("--network=host");
+	});
+
 	it("stops old container before starting new one", () => {
 		expect(deployJob).toContain("docker stop epicnext-cms-app");
 		expect(deployJob).toContain("docker rm epicnext-cms-app");