DL-540

ghcr.io/rigelbuild/compass-server is built from the .#compass-server nix closure on a digest-pinned distroless static-debian12 base, runs as 65532:65532, is published by digest through the shared –lane runner|server publish and retag scripts, and is gated by SERVER_IMAGE_CLOSURE_PATHS.

Status: Active (Matt, 2026-10-17)