test: fix docker test-image env and container-specific test guards

Make the full pnpm test:docker suite pass the env-dependent tests (~85 failures):
- Dockerfile.test: ENV LD_LIBRARY_PATH=/usr/local/lib so the built libheif 1.21 is not shadowed by the base image's older system libheif (heif-dec failed with an undefined-symbol error -> 'No HEIF decoder found' on 72 HEIF tests); add libjxl-tools (JXL) and ghostscript + the ImageMagick policy.xml EPS allow-edit.
- docker-compose.test.yml: SYNC_WAIT_MS=30000 so sync-wait image tools do not fall back to 202 under single-container contention (10 tests).
- install_feature.py: guard tarfile.extractall(filter='data') behind Python>=3.12 (bookworm ships 3.11); the manual entry guards already protect.
- feature-status.test.ts / docker-file-secrets.test.ts: skip the two cases that cannot hold inside the container (/.dockerenv always present; root bypasses chmod). Verified on host: all still pass.

tests/unit/docker-file-secrets.test.ts

@@ -117,7 +117,9 @@ describe("Docker _FILE secret convention", () => {
     ).toThrow();
   });
 
-  it("errors when _FILE points to unreadable file", () => {
+  // root (the test container's uid) bypasses chmod-based permission checks, so
+  // the unreadable-file case cannot be exercised there; skip it.
+  it.skipIf(process.getuid?.() === 0)("errors when _FILE points to unreadable file", () => {
     const secretPath = writeSecret("unreadable.txt", "secret");
     chmodSync(secretPath, 0o000);
     try {