test: fix docker test-image env and container-specific test guards

Make the full pnpm test:docker suite pass the env-dependent tests (~85 failures):
- Dockerfile.test: ENV LD_LIBRARY_PATH=/usr/local/lib so the built libheif 1.21 is not shadowed by the base image's older system libheif (heif-dec failed with an undefined-symbol error -> 'No HEIF decoder found' on 72 HEIF tests); add libjxl-tools (JXL) and ghostscript + the ImageMagick policy.xml EPS allow-edit.
- docker-compose.test.yml: SYNC_WAIT_MS=30000 so sync-wait image tools do not fall back to 202 under single-container contention (10 tests).
- install_feature.py: guard tarfile.extractall(filter='data') behind Python>=3.12 (bookworm ships 3.11); the manual entry guards already protect.
- feature-status.test.ts / docker-file-secrets.test.ts: skip the two cases that cannot hold inside the container (/.dockerenv always present; root bypasses chmod). Verified on host: all still pass.

docker/Dockerfile.test

@@ -39,6 +39,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     libimage-exiftool-perl \
     imagemagick \
     libraw-dev \
+    libjxl-tools \
+    ghostscript \
     && if apt-cache show libx265-199 >/dev/null 2>&1; then \
          apt-get install -y --no-install-recommends libx265-199; \
        elif apt-cache show libx265-209 >/dev/null 2>&1; then \
@@ -48,8 +50,18 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 
 COPY --from=libheif-builder /opt/libheif/bin/ /usr/local/bin/
 COPY --from=libheif-builder /opt/libheif/lib/ /usr/local/lib/
+# The base image ships an older system libheif (~1.15) that shadows our built
+# 1.21 without this, so heif-dec fails with an undefined-symbol error.
+ENV LD_LIBRARY_PATH=/usr/local/lib
 RUN ldconfig
 
+# Allow ImageMagick's Ghostscript delegate to read/write EPS (the default
+# Debian policy.xml blocks it).
+RUN POLICY_FILE=$(find /etc/ImageMagick* -name policy.xml 2>/dev/null | head -1) && \
+    if [ -n "$POLICY_FILE" ]; then \
+      sed -i 's/<policy domain="coder" rights="none" pattern="EPS"/<policy domain="coder" rights="read|write" pattern="EPS"/' "$POLICY_FILE"; \
+    fi
+
 WORKDIR /app
 
 # Copy workspace config first (for layer caching)

docker/docker-compose.test.yml

@@ -25,6 +25,9 @@ services:
       - WORKSPACE_PATH=/tmp/test-workspace
       - MAX_MEGAPIXELS=100
       - RATE_LIMIT_PER_MIN=1000
+      # Single constrained container; give sync-wait tools more headroom before
+      # the factory falls back to async 202 (default is 8s).
+      - SYNC_WAIT_MS=30000
     tmpfs:
       - /tmp/test-workspace
       - /tmp