[Phase 16] Write the Docker standard (prerequisite of S13) #888

Roadmap · Phase 16 · prerequisite of step S13 · size M · planned in docs/roadmap/phase-16-trust-surface-hardening.md:898-903

Summary

Dockerfile, docker-compose.yaml, .dockerignore and the EN/TR operations manual all ship, but no standard governs them: the only rule anywhere is a post-release checkbox in release.md, and no workflow under .github/workflows/ builds or smoke-tests the image. Phase 16 S13 has nothing to be reviewed against until this exists.

What the standard must settle

• A base-image digest-pinning policy.
• A runtime-versus-devel stage rule.
• A non-root user with an owned cache path.
• Service naming.
• A CI smoke obligation.

Acceptance criteria

• The standard lives under docs/standards/ in the layout documentation.md prescribes and is listed in docs/standards/README.md.
• It answers every point above with a rule a reviewer can check, not a description.
• Phase 16 step S13 can be reviewed against it.

_{Planned in docs/roadmap/phase-16-trust-surface-hardening.md (read at f94595f). Unit IDs (F-W20260729-…) come from the 2026-07-29/30 full-project review; the issue numbers next to them are the October 2026 review's records of the same defects.}