Feat v0.3.8 distribution (#21)

Bundled packages auto-install on first boot for zero-config first run.
Builder image for faster custom builds. Per-environment allowlists for
K8s/Helm (dev=all, test=all, prod=skip).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -33,6 +33,7 @@ services:
       EXT_ALLOW_PRIVATE_IPS: ${EXT_ALLOW_PRIVATE_IPS:-true}
       LOG_FORMAT: ${LOG_FORMAT:-text}
       LOG_LEVEL: ${LOG_LEVEL:-info}
+      BUNDLED_PACKAGES: ${BUNDLED_PACKAGES:-}
       # Dev seed users — ignored if ENVIRONMENT=production
       SEED_USERS: ${SEED_USERS:-alice:password123:user,bob:password456:user,charlie:password789:user}
     volumes: