fix(runtime): harden smoke and credential boundaries

compose.yaml

@@ -39,9 +39,16 @@ services:
       context: .
       dockerfile: runtime/Dockerfile
     environment:
+      DOMAIN: ${DOMAIN:?set DOMAIN in .env}
+      PUBLIC_SCHEME: ${PUBLIC_SCHEME:-https}
+      ACME_EMAIL: ${ACME_EMAIL:?set ACME_EMAIL in .env}
       CORE_SOURCE_MODE: clone
       CORE_REPOSITORY_URL: ${CORE_REPOSITORY_URL:?set CORE_REPOSITORY_URL in .env}
       CORE_BOOTSTRAP_REF: ${CORE_BOOTSTRAP_REF:-main}
+      CORE_REPOSITORY_USERNAME: ${CORE_REPOSITORY_USERNAME:-}
+      CORE_REPOSITORY_TOKEN: ${CORE_REPOSITORY_TOKEN:-}
+      CORE_SSH_PRIVATE_KEY_BASE64: ${CORE_SSH_PRIVATE_KEY_BASE64:-}
+      CORE_SSH_KNOWN_HOSTS_BASE64: ${CORE_SSH_KNOWN_HOSTS_BASE64:-}
       POSTGRES_HOST: postgres
       POSTGRES_PORT: '5432'
       POSTGRES_DB: ${POSTGRES_DB:-sammo}
@@ -101,6 +108,11 @@ services:
       timeout: 5s
       retries: 30
       start_period: 5m
+    mem_limit: ${RUNTIME_MEMORY_LIMIT:-4g}
+    memswap_limit: ${RUNTIME_MEMORY_SWAP_LIMIT:-4g}
+    cpus: ${RUNTIME_CPU_LIMIT:-4}
+    pids_limit: ${RUNTIME_PIDS_LIMIT:-256}
+    stop_grace_period: 30s
     restart: unless-stopped
 
   caddy: