fix(docker): ship the realtime and migrations images with runtime dependencies only - #9983

Summary

• Bun's --omit=dev skips the root's devDependencies but still installs every workspace member, each member's devDependencies, and any optional peers the lockfile can satisfy. So the realtime and migrations images shipped drizzle-kit (with its bundled esbuild binaries), vitest, vite and tsx. The esbuild Go binaries accounted for almost every HIGH/CRITICAL scanner finding in both images.
• New scripts/prune-production-workspace.ts narrows a turbo prune --docker output to the workspace members the target actually reaches through dependencies, optionalDependencies, or a tsconfig.json extends (Bun reads tsconfig at runtime). It drops every other member, such as @sim/testing, and strips devDependencies from the root and the kept members. The root's devDependencies have to go too: otherwise Bun links the locked vitest to satisfy better-auth's optional peer.
• The realtime image uses that narrowed workspace.
• The migrations image now uses turbo prune like realtime, which replaces the hand-maintained manifest list.
  • Its final stage (the default) runs db:migrate with runtime dependencies only.
  • A new dev stage keeps drizzle-kit for the dev environment's db:push --force. image-dev builds that stage through a new target input on the image action.
  • Staging, production, GHCR, docker-compose and Helm all build the default stage.
• The narrowed installs drop --frozen-lockfile, as the migrations image already did. Bun keeps every locked resolution, and full-repository CI owns frozen-lockfile validation. I checked every installed third-party package against the repo lockfile: realtime 118/118 and migrations 6/6 are at a locked version.

Type of Change

• Bug fix

Testing

• Built all three images locally (arm64):

  Image	Before	After	node_modules
  realtime	1.21 GB	562 MB	592 MB → 128 MB
  migrations	1.07 GB	428 MB	490 MB → 21 MB
  migrations dev stage	—	1.07 GB	still carries drizzle-kit, as dev needs

• Neither production image contains drizzle-kit, @esbuild-kit, esbuild, tsx, vite, vitest, typescript or @sim/testing.

• trivy HIGH/CRITICAL findings:

  • realtime: 4 critical + 56 high → 1 critical + 2 high. The remainder is the existing better-auth advisories, which are a runtime dependency and out of scope here.
  • migrations: 3 critical + 69 high → none.

• Ran bun run db:migrate from the new migrations image against a scratch pgvector pg17 database: it completes.

• Booted the new realtime image against scratch Postgres and Redis: /health returns 200 and the socket.io polling handshake succeeds.

• biome on the new script.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)