feat(05-04): split prod and fullstack compose artifacts

- add bot-only production compose contract
- add health-gated internal fullstack harness

docker-compose.prod.yml

@@ -0,0 +1,21 @@
+services:
+  matrix-bot:
+    build: .
+    environment:
+      MATRIX_HOMESERVER: ${MATRIX_HOMESERVER:-}
+      MATRIX_USER_ID: ${MATRIX_USER_ID:-}
+      MATRIX_PASSWORD: ${MATRIX_PASSWORD:-}
+      MATRIX_ACCESS_TOKEN: ${MATRIX_ACCESS_TOKEN:-}
+      MATRIX_PLATFORM_BACKEND: ${MATRIX_PLATFORM_BACKEND:-real}
+      MATRIX_AGENT_REGISTRY_PATH: ${MATRIX_AGENT_REGISTRY_PATH:-config/matrix-agents.yaml}
+      AGENT_BASE_URL: ${AGENT_BASE_URL:-}
+      SURFACES_WORKSPACE_DIR: ${SURFACES_WORKSPACE_DIR:-/agents}
+      PYTHONUNBUFFERED: "1"
+    volumes:
+      - agents:/agents
+      - ./config:/app/config:ro
+    restart: unless-stopped
+
+volumes:
+  agents:
+    name: ${SURFACES_SHARED_VOLUME:-surfaces-agents}