first commit

compose.staging.yaml

@@ -0,0 +1,20 @@
+name: dtf-staging-readiness
+
+# This composition root is only a network-disabled readiness gate. It does not
+# deploy the application or connect to R2, Mercado Pago, freight, Tiny/Olist,
+# WhatsApp, a production database, or any other external service.
+services:
+  readiness:
+    build:
+      context: .
+      dockerfile: local/Dockerfile
+    command: python -m local.staging_readiness /config/staging.env
+    volumes:
+      - ./staging/staging.env:/config/staging.env:ro
+    network_mode: none
+    read_only: true
+    tmpfs: [/tmp]
+    init: true
+    pids_limit: 64
+    cap_drop: [ALL]
+    security_opt: [no-new-privileges:true]