ci: add sed to the image

deps: atproto Spaces alpha SDK moves to the 2026-10-22 build (0.0.0-spaces-alpha-20261022141228, published 13 min after atproto ac0c9f1, the next pds-spaces-alpha image), and space reads accept either PDS build's commit shape so this client deploys ahead of the PDS flip — ac0c9f1 replaced `#signedCommit` {ver,hash,ikm,sig,mac,rev} with `#commit` {ver,repo,space,rev,data}, and the SDK validates every response, so the 10-15 SDK rejects the new PDS's getLatestCommit and any listRepoOps page that reaches the head (every sync cycle), and the 10-22 SDK rejects the old PDS's the same way. repo.ts's commitShapeMismatch takes a body rejected at Output/commit as-is: head() reads commit.rev (both shapes carry it), listOps() drops the unused commit and re-validates the rest, so a page wrong anywhere else still throws. Drop it once bag.laugh.town runs ac0c9f1. The rest of the range doesn't touch chalky: commit MACs only apply to space-credential / Atproto-Space-Want-Mac reads (OAuth reads skip them), getRepo (CAR→STAR, excludeValues gone) and getSpaceCredential (auth in body) aren't called, and the only DID-doc entry read is #atproto_pds, not #atproto_space. oauth-client-browser's dist is byte-identical, so the WebKit null-IDB patch carries over (renamed; same patch_hash). Verified by driving SpaceRepo through Vite SSR against mocked responses: main fails head/listOps on the new shape, the bump alone fails on the old one, bump + fallback passes on both and still rejects a page with invalid ops; not exercised signed-in against a real PDS; pnpm check 0 errors 0 warnings, pnpm build ok, Dockerfile build ok