fix(docker): address review findings

Entrypoint drops the capability bounding set and sets no_new_privs. Security docs
and spec no longer claim the agent can't reach the secrets; docker exec fallbacks
use a clean environment. PLAYWRIGHT_ENABLED drops the nested compose default.
Tests pin the Dockerfile's Playwright install step and the compose model fallback.

.gitignore

@@ -16,3 +16,5 @@ artifacts/
 .claude/
 # Local compose configuration (secrets)
 .env
+.env.*
+!.env.example