Implement approval engine production readiness

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a05e2e-805b-7042-a750-71f473bceea2

Containerfile

@@ -0,0 +1,19 @@
+FROM python:3.12-slim@sha256:d764629ce0ddd8c71fd371e9901efb324a95789d2315a47db7e4d27e78f1b0e9
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PATH=/opt/venv/bin:$PATH
+
+RUN python -m venv /opt/venv \
+    && addgroup --system --gid 10001 approval \
+    && adduser --system --uid 10001 --ingroup approval --no-create-home approval
+
+WORKDIR /app
+COPY pyproject.toml README.md ./
+COPY approval_engine ./approval_engine
+RUN pip install --no-cache-dir '.[serve]'
+
+USER 10001:10001
+EXPOSE 8080
+ENTRYPOINT ["approval-engine"]
+CMD ["serve", "--help"]