fix(docker): ship uv in orchestrator runner, set production env + host userns

The orchestrator runner stage lacked uv, so workspace dep pre-install
(`uv sync`) and `uv run` CI commands failed at runtime; copy uv from the
builder stage like agent-base does. Set ROBOCO_ENVIRONMENT=production on
the orchestrator service so structlog emits JSON instead of console output.
Add userns_mode: "host" so the orchestrator's chown of cloned workspaces to
the agent uid isn't blocked by docker's user-namespace remap.

docker-compose.yaml

@@ -235,6 +235,13 @@ services:
       ROBOCO_HOST_PROJECT_DIR: ${ROBOCO_HOST_PROJECT_DIR:-/volume1/roboco}
       ROBOCO_HOST_CLAUDE_DIR: ${ROBOCO_HOST_CLAUDE_DIR:-/home/renzof/.claude}
       ROBOCO_HOST_DATA_DIR: ${ROBOCO_HOST_DATA_DIR:-/volume1/roboco/data}
+      # Production environment selects structlog's JSONRenderer (machine-
+      # parseable logs) over the dev ConsoleRenderer.
+      ROBOCO_ENVIRONMENT: production
+    # Run in the host user namespace so the orchestrator's chown of cloned
+    # workspaces to the agent uid (1000) isn't blocked by docker's userns
+    # remap (which would shift ownership out of the expected uid range).
+    userns_mode: "host"
     volumes:
       # Docker socket - allows spawning agent containers
       - /var/run/docker.sock:/var/run/docker.sock

docker-compose.yml

@@ -239,6 +239,13 @@ services:
       # unusable links in commit message bodies; set to NAS LAN IP so
       # f"{api_base}/tasks/{task_id}" renders a reachable URL.
       ROBOCO_PUBLIC_BASE_URL: "http://192.168.50.111:8000"
+      # Production environment selects structlog's JSONRenderer (machine-
+      # parseable logs) over the dev ConsoleRenderer.
+      ROBOCO_ENVIRONMENT: production
+    # Run in the host user namespace so the orchestrator's chown of cloned
+    # workspaces to the agent uid (1000) isn't blocked by docker's userns
+    # remap (which would shift ownership out of the expected uid range).
+    userns_mode: "host"
     volumes:
       # Docker socket - allows spawning agent containers
       - /var/run/docker.sock:/var/run/docker.sock

docker/orchestrator.Dockerfile

@@ -70,6 +70,11 @@ WORKDIR /app
 # Copy the already-built venv + app tree from builder
 COPY --from=builder /app /app
 
+# uv is needed at runtime: WorkspaceService runs `uv sync` to pre-install
+# Python cell deps, and CI commands shell out to `uv run`. The builder stage
+# has it at /usr/local/bin/uv; carry it into the runner so it's on PATH.
+COPY --from=builder /usr/local/bin/uv /usr/local/bin/uv
+
 # Orchestrator clones workspaces as root, then chowns them to the agent
 # user (uid 1000) so the agent container can read/write. After the chown,
 # the orchestrator (still root) needs to run git commands (claim branch