fix(docker): ship uv in orchestrator runner, set production env + host userns

The orchestrator runner stage lacked uv, so workspace dep pre-install
(`uv sync`) and `uv run` CI commands failed at runtime; copy uv from the
builder stage like agent-base does. Set ROBOCO_ENVIRONMENT=production on
the orchestrator service so structlog emits JSON instead of console output.
Add userns_mode: "host" so the orchestrator's chown of cloned workspaces to
the agent uid isn't blocked by docker's user-namespace remap.

docker/orchestrator.Dockerfile

@@ -70,6 +70,11 @@ WORKDIR /app
 # Copy the already-built venv + app tree from builder
 COPY --from=builder /app /app
 
+# uv is needed at runtime: WorkspaceService runs `uv sync` to pre-install
+# Python cell deps, and CI commands shell out to `uv run`. The builder stage
+# has it at /usr/local/bin/uv; carry it into the runner so it's on PATH.
+COPY --from=builder /usr/local/bin/uv /usr/local/bin/uv
+
 # Orchestrator clones workspaces as root, then chowns them to the agent
 # user (uid 1000) so the agent container can read/write. After the chown,
 # the orchestrator (still root) needs to run git commands (claim branch