chore: container hardening — read-only root FS + tmpfs /tmp + Python env #60

Job	Run time
Commit-type sync	11s
Frontend Quality	18s
Unit tests	21s
Pre-commit	1m 1s
Architecture (import-linter)	14s
Lint & Format	11s
Type Check	18s
Branch-protection contexts sync	10s
Coverage	22s
Frontend Build	16s
	3m 22s

Provide feedback