fix(gateway): harden workspace repository cloning

docker/gateway.Dockerfile

@@ -25,15 +25,20 @@ WORKDIR /app
 ENV NODE_ENV=production
 # WorkspaceService shells out to git at runtime and roots workspaces at
 # $MOSAIC_ROOT/.workspaces (apps/gateway/src/workspace/workspace.service.ts);
-# mount a volume over /opt/mosaic to persist workspaces across container restarts
-RUN apk add --no-cache git && mkdir -p /opt/mosaic/.workspaces
+# mount a volume over /opt/mosaic to persist workspaces across container restarts.
+# Intentionally unpinned: Alpine's signed repository is the trust anchor; pinning
+# git was declined so routine base-image security updates remain maintainable.
+RUN apk add --no-cache git \
+  && mkdir -p /opt/mosaic/.workspaces \
+  && chown -R node:node /opt/mosaic /app
 ENV MOSAIC_ROOT=/opt/mosaic
 # Use the pnpm deploy output — resolves all deps into a flat, self-contained node_modules
-COPY --from=builder /deploy/node_modules ./node_modules
-COPY --from=builder /deploy/package.json ./package.json
+COPY --chown=node:node --from=builder /deploy/node_modules ./node_modules
+COPY --chown=node:node --from=builder /deploy/package.json ./package.json
 # dist is declared in package.json "files" so pnpm deploy copies it into /deploy;
 # copy from builder explicitly as belt-and-suspenders
-COPY --from=builder /app/apps/gateway/dist ./dist
+COPY --chown=node:node --from=builder /app/apps/gateway/dist ./dist
 # gateway defaults to port 14242 (apps/gateway/src/main.ts)
 EXPOSE 14242
+USER node
 CMD ["node", "dist/main.js"]