Dockerfile: add coreutils to the test stage, for GNU cp

busybox cp makes a new file, so the test that
script/commit-upstream-policy-files survives replacing itself passed
even with the .new name and mv removed from
script/write-upstream-policy-files. GNU cp writes into the existing
file, as cp does on most hosts, and the test now fails without them.

Model: opus-5-5

Dockerfile

@@ -26,11 +26,15 @@ COPY . .
 
 RUN yarn run prettier --check '**/*.md' --tab-width 4 --prose-wrap always
 
-# Test phase, same shape and for the same reason.
+# Test phase, same shape and for the same reason. coreutils makes cp GNU
+# cp, which writes into an existing file, as cp does on most hosts.
+# busybox cp makes a new file, so test/commit-upstream-policy-files.sh
+# would pass even if script/write-upstream-policy-files copied straight
+# over the running script/commit-upstream-policy-files.
 #
 # alpine 3.24.3, 2026-11-04
 FROM alpine@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a AS test
-RUN apk add --no-cache git make nodejs-current yarn
+RUN apk add --no-cache coreutils git make nodejs-current yarn
 ARG CACHEBUST
 
 WORKDIR /app