hatch3r-containerize

# Containerization Workflow Companion workflow to the `hatch3r-devops` agent: that agent reviews and authors infrastructure across CI/CD, IaC, and orchestration with apply-step gating; this skill is the focused step-by-step procedure for producing a hardened container image and its local + orchestration manifests. Use this skill when the task is "containerize this service" or "harden this Dockerfile"; escalate to the agent when the work spans pipelines, cloud IaC, or a deployment strategy. ## Quick Start ``` Task Progress: - [ ] Step 0: Detect ambiguity (P8 B1) - [ ] Step 1: Pick a minimal base image + plan build/runtime split - [ ] Step 2: Write the multi-stage Dockerfile - [ ] Step 3: Harden — non-root USER, dropped privileges, HEALTHCHECK - [ ] Step 4: Add .dockerignore + verify build context size - [ ] Step 5: Author docker-compose for local dev - [ ] Step 6: Author Kubernetes manifest with securityContext - [ ] Step 7: Scan the image and gate on findings ``` Two invariants bound every image this workflow produces: it runs as a non-root user, and it ships only runtime artifacts (no build toolchain, no secrets). Steps 2–3 establish both; Step 7 verifies them. ## Step 0 — Detect Ambiguity (P8 B1) Before any work, scan the invocation for unresolved questions in scope, intent, acceptance criteria, target environment, or irreversibility. If any are found, ask the user via the platform-native question tool per `agents/shared/user-question-protocol.md`. Do not proceed unde...