[SandObserver]

Summary

• Name the runtime stage base, then copy it into a FROM scratch stage with COPY --from=base / / so the deleted npm, yarn, corepack and C headers no longer ship in a lower layer. The image is about 24 MB smaller on disk and about 7 MB smaller compressed, on amd64 and arm64.
• Also remove /usr/local/include/node from the runtime image, and fail the build if node.h is still anywhere in it.
• Reset every directory time in the base stage to the node binary's time, so the copied layer is identical for one base digest and updates reuse it.
• Set nginx worker_processes 1 instead of auto with sed, and fail the build with grep -qx if the line does not apply. auto starts one worker per host core and ignores container CPU limits.
• NODE_VERSION and YARN_VERSION are no longer set in the image. Nothing reads them.
• Update the Dockerfile shape tests for the new stages. The runtime-content tests check every shipped stage, not only the last.

Testing
All green, including the Docker build and image scan. Added 2 tests for the nginx worker setting and the reproducible base layer.

Changelog

Changed

• Shrink the image by about 24 MB and run one nginx worker instead of one per CPU core.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.