chore: Split Dockerfile into base and pixi layers

[effigies]

FreeSurfer downloads are extremely finicky, and I feel bad about hitting their server as much as we do. This is something we experimented on in PETPrep, to put the non-Pixi (conda, in PETPrep) dependencies in one image that gets pushed to ghcr.io, and then building on top of that.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.68%. Comparing base (04ef0cf) to head (a78f3ef).
⚠️ Report is 24 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3521      +/-   ##
==========================================
+ Coverage   73.64%   73.68%   +0.03%     
==========================================
  Files          60       60              
  Lines        4759     4758       -1     
  Branches      616      616              
==========================================
+ Hits         3505     3506       +1     
+ Misses       1111     1110       -1     
+ Partials      143      142       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[effigies]

This drops CircleCI builds down to 10m (usually 30m+). GHA is pretty much unchanged (3m usually, 6m on master because of the push).

It also will do a better job of ensuring that successive releases reuse the same base layers.