feat(runtime): 정적 프런트엔드와 격리 빌더를 구성한다

Caddy가 불변 아티팩트를 직접 제공하고 runtime과 builder의 자원·비밀 경계를 분리한다.

Gateway active release ref를 재기동에 복원하고 production/development/smoke 모델 검증을 확장한다.

compose.yaml

@@ -34,6 +34,37 @@ services:
       start_period: 5s
     restart: unless-stopped
 
+  builder:
+    build:
+      context: .
+      dockerfile: runtime/Dockerfile
+    entrypoint: [/usr/bin/tini, --, node, /opt/sammo/release-builder.mjs]
+    environment:
+      CI: 'true'
+      NODE_OPTIONS: ${BUILDER_NODE_OPTIONS:---max-old-space-size=3072}
+      PROFILE_FRONTEND_BUILD_NODE_OPTIONS: ${PROFILE_FRONTEND_BUILD_NODE_OPTIONS:---max-old-space-size=3072}
+      RAYON_NUM_THREADS: ${BUILDER_RAYON_NUM_THREADS:-2}
+      RELEASE_TURBO_CONCURRENCY: ${RELEASE_TURBO_CONCURRENCY:-1}
+      TURBO_CACHE_DIR: /srv/builder-cache/turbo
+      XDG_DATA_HOME: /srv/builder-cache/xdg
+      RELEASE_BUILDER_PORT: '15100'
+      TZ: ${TZ:-Asia/Seoul}
+    volumes:
+      - core-source:/srv/core
+      - builder-cache:/srv/builder-cache
+    healthcheck:
+      test: [CMD, curl, --fail, --silent, http://127.0.0.1:15100/healthz]
+      interval: 5s
+      timeout: 5s
+      retries: 24
+      start_period: 5s
+    mem_limit: ${BUILDER_MEMORY_LIMIT:-4g}
+    memswap_limit: ${BUILDER_MEMORY_SWAP_LIMIT:-4g}
+    cpus: ${BUILDER_CPU_LIMIT:-4}
+    pids_limit: ${BUILDER_PIDS_LIMIT:-256}
+    stop_grace_period: 15s
+    restart: unless-stopped
+
   runtime:
     build:
       context: .
@@ -89,6 +120,11 @@ services:
       GATEWAY_API_HOST: 0.0.0.0
       GATEWAY_API_PORT: '15001'
       GATEWAY_FRONTEND_PORT: '15000'
+      FRONTEND_SERVE_MODE: static
+      FRONTEND_ARTIFACT_ROOT: /srv/frontend-artifacts
+      FRONTEND_READINESS_ORIGIN: http://caddy
+      RELEASE_BUILDER_URL: http://builder:15100
+      RELEASE_BUILD_NODE_OPTIONS: ${BUILDER_NODE_OPTIONS:---max-old-space-size=3072}
       GATEWAY_TRPC_PATH: /gateway/api/trpc
       CORE_NAVIGATION_CONFIG_FILE: /srv/data/navigation.json
       GATEWAY_INTERNAL_API_URL: http://127.0.0.1:15001
@@ -97,6 +133,7 @@ services:
       GATEWAY_WORKTREE_ROOT: /srv/core/profile-worktrees
       RELEASE_CONTROLLER_WORKSPACE_ROOT: /srv/core/repository
       RELEASE_CONTROLLER_WORKTREE_ROOT: /srv/core/release-worktrees
+      GATEWAY_ACTIVE_RELEASE_GIT_REF: refs/sammo/active-gateway
       GATEWAY_BASE_PATH: /gateway
       VITE_APP_BASE_PATH: /gateway
       VITE_GATEWAY_API_URL: /gateway/api/trpc
@@ -110,6 +147,7 @@ services:
     volumes:
       - core-source:/srv/core
       - runtime-data:/srv/data
+      - frontend-artifacts:/srv/frontend-artifacts
       - ${IMAGE_UPLOAD_CORE2026_SECRET_FILE:?set IMAGE_UPLOAD_CORE2026_SECRET_FILE in .env}:/run/secrets/image_upload_core2026_secret:ro
       - ${IMAGE_SYNC_CORE2026_SECRET_FILE:?set IMAGE_SYNC_CORE2026_SECRET_FILE in .env}:/run/secrets/image_sync_core2026_secret:ro
     depends_on:
@@ -117,6 +155,8 @@ services:
         condition: service_healthy
       redis:
         condition: service_healthy
+      builder:
+        condition: service_healthy
     healthcheck:
       test: [CMD, curl, --fail, --silent, http://127.0.0.1:15001/healthz]
       interval: 10s
@@ -143,6 +183,7 @@ services:
     volumes:
       - ./caddy/Caddyfile:/etc/caddy/Caddyfile:ro
       - ./data/image:/srv/image:ro
+      - frontend-artifacts:/srv/frontend-artifacts:ro
       - caddy-data:/data
       - caddy-config:/config
     depends_on:
@@ -155,5 +196,7 @@ volumes:
   redis-data:
   core-source:
   runtime-data:
+  frontend-artifacts:
+  builder-cache:
   caddy-data:
   caddy-config: