Keep testing helpers out of production builds

[lucarlig]

Production builds include the plugin factories and health endpoint while excluding the unauthenticated token, JWKS and user-config helpers behind with_tools. Docker builds, image publishing and the CI conformance binary use the same production feature selection.

Conformance keeps the crates.io release installation through cargo binstall cf-integration@0.3.2 --no-confirm, matching the version in contextforge-org/contextforge-dev-tools#14. This requires merging that PR and publishing version 0.3.2 before running conformance CI. The harness owns JWT signing, loopback JWKS and Redis fixture publication. Official conformance and Inspector install and run Node/npm inside Docker; the workflow no longer installs Node on the host.

The branch includes main's PR-head artifact fix: the producer, artifact name and consumer checkout use the same head SHA. Compose uses the token issuer's JWKS URL without mounting signing keys into dataplane containers. Documentation covers production builds, testing-only helpers and the versioned release installation.

E2E validation at 7f1961c with a harness binary built from PR #14 at 957eeb1 (version 0.3.2):

• Built the release image with make docker-prod. Eight live boundary checks pass: health GET/HEAD, health POST rejection, four absent helper routes, and unauthenticated MCP rejection. The authenticated standalone probe also passes.
• Release-image load smoke: 42 requests, zero failures. Strict make conformance completes all 84 scenarios: 44 passed, 40 expected failures, zero unexpected failures/passes, skips or unknowns. Dataplane and harness baselines are unchanged.
• The new CLI downloaded the exact 7f1961c binary from CI run 34235710851 and built the Linux x86-64 image through ci prepare-image. Local E2E against that image passes the same boundary checks, probe and 84 conformance outcomes; load completed 27 requests with zero failures. All 311 individual check identifiers, names and statuses match the ARM64 release image.
• Built and installed the CLI from the tested PR Add concurrency failure-harness checks #14 source revision. The published 0.3.2 installation remains to be verified after release. Host node, npm and npx traps were not invoked; no host npm cache was created.
• 247 workspace tests pass, with 13 existing ignored tests. Formatting, Clippy, workspace build, deny, shear, docs build/tests, Compose validation, Actionlint and commit hooks pass.
• CI, docs and DCO checks pass.

Temporary validation containers, networks and volumes were removed. All original user containers remain running.

Follow-up 5a1dc13 restores release installation and updates its documentation; runtime code is unchanged. Actionlint, mdBook build/tests, rendered installation instructions and all commit hooks (formatting, Clippy, deny, nextest and build) pass.