[jonbaldie]

Summary

Docker + CI + shipped-binary regression
  → scripts/compile.ts [isolated output path]
    → shared ENV_VAR_NAMES from src/config.ts

Preserves current production grants and per-dimension probes. Removes the stale hardening script.

Closes #184

Evidence

• Before: missing shared compile operation fails the shipped regression.
  After: all 3 compiled-binary tests pass, including HTTP persistence across restart and runtime HOST/PORT.
• Omitting PORT from the shared env grant makes the shipped regression fail with NotCapable.
• Docker builds through the operation and serves authenticated enqueue/dequeue as UID 1993.
• Frozen typecheck passes. Full local suite: 379 passed, 1 failed because Stryker is not installed locally; CI installs that tool.
• Two-axis review: fixed missing bound-host assertion; retained explicit per-test temporary-directory cleanup for readability.

Merge Danger

Door: two-way

Blast Radius: builds

No runtime configuration or permission broadening; revert restores the previous build entry points.

[jonbaldie]

Review complete: Standards — no documented breaches; minor repeated test-cleanup boilerplate retained for readability. Spec — the initial missing bound-host assertion is fixed and re-review found no remaining gaps. Test evidence audit: all three compiled-binary cases are production-grounded (real process startup/HTTP/restart), no mocks. Missing shared PORT grant was mutation-tested and correctly fails the shipped regression. Docker build and non-root HTTP smoke passed. Local full suite: 379 pass, one missing-Stryker-tool failure; CI Test/Production quality/Mutasaurus are green, awaiting Stryker.