fix(docker): ship uv in orchestrator runner, set production env + host userns

The orchestrator runner stage lacked uv, so workspace dep pre-install
(`uv sync`) and `uv run` CI commands failed at runtime; copy uv from the
builder stage like agent-base does. Set ROBOCO_ENVIRONMENT=production on
the orchestrator service so structlog emits JSON instead of console output.
Add userns_mode: "host" so the orchestrator's chown of cloned workspaces to
the agent uid isn't blocked by docker's user-namespace remap.

docker-compose.yml

@@ -239,6 +239,13 @@ services:
       # unusable links in commit message bodies; set to NAS LAN IP so
       # f"{api_base}/tasks/{task_id}" renders a reachable URL.
       ROBOCO_PUBLIC_BASE_URL: "http://192.168.50.111:8000"
+      # Production environment selects structlog's JSONRenderer (machine-
+      # parseable logs) over the dev ConsoleRenderer.
+      ROBOCO_ENVIRONMENT: production
+    # Run in the host user namespace so the orchestrator's chown of cloned
+    # workspaces to the agent uid (1000) isn't blocked by docker's userns
+    # remap (which would shift ownership out of the expected uid range).
+    userns_mode: "host"
     volumes:
       # Docker socket - allows spawning agent containers
       - /var/run/docker.sock:/var/run/docker.sock