feat(infra): T20 S4 image batch - non-root appuser, compose resource limits, unified extensions init mount (I1/I4)

docker-compose.dev.yml

@@ -20,7 +20,8 @@ services:
       - "127.0.0.1:${CONTEXT_DB_PUBLISH_PORT:-${SYSTEM_DB_PUBLISH_PORT:-5433}}:5432"
     volumes:
       - dev-context-pgdata:/var/lib/postgresql/data
-      - ./deploy/postgres/context_init.sql:/docker-entrypoint-initdb.d/01-init.sql:ro
+      # T20-I4: 三环境统一仅初始化扩展；表结构一律走 app goose 迁移（空卷顺序: 扩展→迁移）
+      - ./deploy/postgres/extensions_init.sql:/docker-entrypoint-initdb.d/01-extensions.sql:ro
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U ${CONTEXT_DB_USER:-${SYSTEM_DB_USER:-app}} -d ${CONTEXT_DB_NAME:-${SYSTEM_DB_NAME:-agent_system_dev}}"]
       interval: 5s
@@ -68,6 +69,10 @@ services:
       - dev-net
 
   app:
+    # T20-I1: 资源上限（防 OOM 连坐；app 限额独立于 runner）
+    mem_limit: 1536m
+    mem_reservation: 768m
+    cpus: 1.5
     build:
       context: .
       dockerfile: deploy/app/Dockerfile
@@ -164,6 +169,10 @@ services:
       - shared-net
 
   events:
+    # T20-I1: 资源上限（防 OOM 连坐；events 限额独立于 runner）
+    mem_limit: 768m
+    mem_reservation: 384m
+    cpus: 1.0
     build:
       context: .
       dockerfile: deploy/app/Dockerfile