[haksungjang]

docker-compose.yml only passes the keys it names in a service's environment, and 25 keys that .env.example offers and the backend reads were never named: the GATE_* axis switches, EPSS_*, LOGIN_THROTTLE_*, three rate limits, the default task time limits, STALE_QUEUED_SCAN_GRACE_SECONDS, REQUIRE_DB_ROLE_SEPARATION, GROUP_CASCADE_ENABLED, CONTAINER_SCAN_ALLOWED_REGISTRIES and the GitLab comment settings. They are now in the shared anchor. Where the code has a default, the value after :- is that default, because ${KEY:-} hands the process an empty string and os.getenv(KEY, default) returns it. Where the code has none, a test shows an empty value takes the same path as an unset one.

Checking every anchor default against the code turned up one live case of that problem: TOOLCHAIN_CACHE_ROOTS was passed as empty, which toolchain_cache_roots() reads as an empty list, so the toolchain cache cleaner had nothing to reclaim. Both compose files now carry the code's list. SCANCODE_ENABLED also differs (compose on, code and template off); it is recorded as a known difference rather than changed here, since flipping it changes what existing deployments scan.

test_config_key_contract.py now classifies every .env.example key as passed or kept out for a stated reason (compose substitution, image build metadata, host scripts, DSN parts, the owner DSN, dev only), checks each reason against the files it names, compares anchor defaults with the code's, and requires an empty-reads-as-unset check for every key passed empty without a code default. The template and reference pages now say which keys reach the containers; the build metadata lines in .env.example are commented out because the image sets them, and the backup retention text no longer claims the nightly backups read BACKUP_RETENTION_DAYS.

Every service's config hash changes with this anchor, so the upgrade UAT should be dispatched on this branch.

Closes #583