feat(runtime): 정적 프런트엔드와 격리 빌더를 구성한다

Caddy가 불변 아티팩트를 직접 제공하고 runtime과 builder의 자원·비밀 경계를 분리한다.

Gateway active release ref를 재기동에 복원하고 production/development/smoke 모델 검증을 확장한다.

.env.example

@@ -20,11 +20,22 @@ RUNTIME_MEMORY_LIMIT=4g
 RUNTIME_MEMORY_SWAP_LIMIT=4g
 RUNTIME_CPU_LIMIT=4
 RUNTIME_PIDS_LIMIT=512
-# Bound Node/Rolldown build parallelism inside the runtime container.
+# Runtime Node limits apply to APIs, daemons, and workers.
 RUNTIME_NODE_OPTIONS=--max-old-space-size=1536
 # Optional turn-daemon-only heap. Raise the runtime memory hard limit first.
 TURN_DAEMON_NODE_OPTIONS=--max-old-space-size=1536
 RUNTIME_RAYON_NUM_THREADS=1
+
+# Isolated release builder. It has no DB, Redis, game-token, OAuth, or Docker
+# socket credentials and serializes validated jobs on the private network.
+BUILDER_MEMORY_LIMIT=4g
+BUILDER_MEMORY_SWAP_LIMIT=4g
+BUILDER_CPU_LIMIT=4
+BUILDER_PIDS_LIMIT=256
+BUILDER_NODE_OPTIONS=--max-old-space-size=3072
+PROFILE_FRONTEND_BUILD_NODE_OPTIONS=--max-old-space-size=3072
+BUILDER_RAYON_NUM_THREADS=2
+RELEASE_TURBO_CONCURRENCY=1
 # Optional smoke-only limits used with compose.smoke.yaml (maximum supported defaults shown).
 # SMOKE_RUNTIME_MEMORY_LIMIT=4g
 # SMOKE_RUNTIME_MEMORY_SWAP_LIMIT=4g