docker build, the TUI checker and the eval runner still write to the project

[ako]

Follow-up to #951 / PR #956. docker check now runs on a temporary copy, but three other paths still write to the user's project:

1. docker build runs update-widgets on the project. On MPRv1 nothing restores it, so the .mpr is rewritten permanently (the same mechanism fix: docker check never modifies the project; atomic catalog cache save (#951) #956 removed from check). Its mx check step also writes theme-cache/ and deployment/sass/. deployment/ is a build output, so writing it is expected. Rewriting the .mpr, or any model unit, is not.
2. The TUI checker (cmd/mxcli/tui/checker.go) runs a plain mx check on the project, which writes theme-cache/ and deployment/sass/.
3. The eval runner (cmd/mxcli/evalrunner/checks.go) does the same.

Fix: reuse #956's copy helper (cmd/mxcli/docker/check_copy.go) for every mx check. For docker build, normalise widgets on a copy, or say up front that it updates widgets in place, and never rewrite the model silently.

Test: the byte-identity test from #956 (hash and mtime of every model file before and after), on v1 and v2.