내부 builder 인증과 실행 허용 목록 및 자원 경계를 적용한다

compose.yaml

@@ -48,10 +48,12 @@ services:
       TURBO_CACHE_DIR: /srv/builder-cache/turbo
       XDG_DATA_HOME: /srv/builder-cache/xdg
       RELEASE_BUILDER_PORT: '15100'
+      RELEASE_BUILDER_TOKEN_FILE: /run/secrets/release_builder_token
       TZ: ${TZ:-Asia/Seoul}
     volumes:
       - core-source:/srv/core
       - builder-cache:/srv/builder-cache
+      - ${RELEASE_BUILDER_TOKEN_FILE:?set RELEASE_BUILDER_TOKEN_FILE in .env}:/run/secrets/release_builder_token:ro
     healthcheck:
       test: [CMD, curl, --fail, --silent, http://127.0.0.1:15100/healthz]
       interval: 5s
@@ -131,6 +133,7 @@ services:
       FRONTEND_SHARED_ASSET_PUBLIC_PATH: /gateway/profile-assets
       FRONTEND_READINESS_ORIGIN: http://caddy
       RELEASE_BUILDER_URL: http://builder:15100
+      RELEASE_BUILDER_TOKEN_FILE: /run/secrets/release_builder_token
       RELEASE_BUILD_NODE_OPTIONS: ${BUILDER_NODE_OPTIONS:---max-old-space-size=3072}
       GATEWAY_TRPC_PATH: /gateway/api/trpc
       CORE_NAVIGATION_CONFIG_FILE: /srv/data/navigation.json
@@ -154,6 +157,7 @@ services:
     volumes:
       - core-source:/srv/core
       - runtime-data:/srv/data
+      - ${RELEASE_BUILDER_TOKEN_FILE:?set RELEASE_BUILDER_TOKEN_FILE in .env}:/run/secrets/release_builder_token:ro
       - frontend-artifacts:/srv/frontend-artifacts
       - ${IMAGE_UPLOAD_CORE2026_SECRET_FILE:?set IMAGE_UPLOAD_CORE2026_SECRET_FILE in .env}:/run/secrets/image_upload_core2026_secret:ro
       - ${IMAGE_SYNC_CORE2026_SECRET_FILE:?set IMAGE_SYNC_CORE2026_SECRET_FILE in .env}:/run/secrets/image_sync_core2026_secret:ro