Production runtime hardening

Added

• Pinned production runtime images and release builds to immutable digests and commit SHAs.
• Added tighter CPU, memory, process, descriptor, filesystem, and Linux capability limits across production services.
• Restricted internal services to private Docker networking and kept public web surfaces behind the reverse proxy.
• Documented deployment verification, rollback, health checks, recovery procedures, and encrypted local backup/restore operations.