fix: harden the CMCP runtime container

[imran-siddique]

Summary

Replace the single-stage editable development install with a two-stage production build. The builder creates a runtime-only wheelhouse; the final image installs it offline, contains no development extras or build source, and runs as numeric UID/GID 10001 from a writable application-data directory.

The base is pinned to the current Python 3.11 patch and Debian suite (python:3.11.15-slim-bookworm), and .dockerignore excludes tests, docs, VCS metadata, databases, logs, and other non-build context.

Root cause

The release image used pip install -e ".[dev]" directly in its final root-owned stage. That shipped test/security/build tools and an editable source tree into production, expanded the dependency and filesystem attack surface, and ran the network gateway as root. It also omitted the repository schema directory, which is why this PR is stacked on #503's packaged-schema fix.

Validation

• Added static release invariants for production-only installation, offline wheelhouse use, non-root UID/GID, and patch/suite-pinned base stages
• Focused container/catalog tests: 24 passed
• Full clean-environment suite: 1054 passed, 8 skipped
• Ruff, mypy, and Bandit: clean
• git diff --check: clean

Docker is not installed in the local Windows environment, so the actual multi-stage build is delegated to the repository's existing Docker build-and-push workflow after the prerequisite branch is merged/retargeted.

Dependency

Stacked on draft PR #503 because the final wheel must contain the mandatory catalog schema.

Documentation

• Added container build invariants to CONTRIBUTING
• Added an Unreleased security changelog entry