fix(deploy): avoid apt npm downloads through proxy

[FZR95]

What changed

• reuse the configured Node base image for the TopicLab Critic runtime instead of installing Debian nodejs and npm
• keep APT limited to Git and add proxy-compatible retries, timeouts, and disabled HTTP pipelining
• explicitly lock deployment commands to the versioned root Compose file
• print and validate the resolved Compose service list, rejecting the obsolete bundled WorldWeave services

Root cause

Production run 29837920363 reached the Docker bridge proxy at 172.17.0.1:1081, but Debian's npm dependency graph required hundreds of small downloads. The proxy repeatedly closed connections (Remote end closed connection) and the build exceeded the 120-minute limit. The same run also built the removed bundled WorldWeave service, showing that stale or inherited Compose selection was affecting the remote deployment.

Validation

• 78 focused Critic, Worker, proxy, runtime-safety, and Zvec tests passed
• Docker Compose config validation passed for all profiles
• resolved production service list contains only skillhub-critic-worker, topiclab-backend, topiclink-zvec, backend, and frontend
• workflow YAML parsing and git diff --check passed
• production docker.m.daocloud.io/library/node:22-slim manifest resolves for linux/amd64