feat: add production container image

[franciscojavierarceo]

Summary

• add a multi-stage BuildKit image that compiles agentic-server with a pinned Rust toolchain and ships only the gateway plus runtime certificates
• run as a non-root, group-0-compatible identity, support arbitrary OpenShift UIDs and UID rotation for SQLite volumes, publish vLLM-compatible build labels, and handle container SIGTERM gracefully
• bind production CLI options to environment variables and add container build, runtime-content, health/readiness, stored Responses API, SQLite persistence, UID-rotation, and shutdown checks in CI
• document local builds, external inference/database configuration, authenticated ingress requirements, legacy-volume permission repair, and Kubernetes/OpenShift security context

Closes #105.

Test Plan

• cargo test
• cargo clippy --all-targets -- -D warnings
• cargo fmt -- --check
• uvx pre-commit run --all-files
• build the image with Docker BuildKit and inspect its runtime identity, executable ownership, contents, OCI/vLLM labels, and linked OpenSSL libraries
• run the image as arbitrary UID 12345:0, submit a stored Responses API request, restart the same SQLite volume as UID 23456:0, and verify two previous_response_id continuations persist successfully
• send SIGTERM to each container and verify exit code 0
• uv run --with-requirements docs/requirements.txt mkdocs build --strict (blocked by the pre-existing broken ROADMAP.md link and missing anchor in docs/design/claude-code-integration.md; reproduced on clean origin/main)