Harden production Docker image and verify runtime permissions

Exclude local secrets and mutable data from image builds, restore Go checksum verification, remove runtime capability tooling and setuid/setgid permissions, and preserve non-root media and demo startup behavior. Add native image smoke checks and document runtime constraints.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

.github/workflows/pr-build.yml

@@ -27,6 +27,8 @@ jobs:
           CID=$(docker create ${{matrix.architecture}})
           docker cp ${CID}:/home/agent ./output-${{matrix.architecture}}
           docker rm ${CID}
+      - name: Test production image
+        run: sh deployments/docker/test-image.sh ${{ matrix.architecture }}
       - name: Strip binary
         run: tar -cf agent-${{matrix.architecture}}.tar -C output-${{matrix.architecture}} . && rm -rf output-${{matrix.architecture}}
       - name: Upload artifact