fix: harden coordinator runtime dependencies

[LukeHackett12]

Summary

• limit the production Bun install to the coordinator workspace and its runtime dependency closure
• update Elysia to 1.4.29 and tar to 7.5.11
• use a numeric non-root runtime user

Validation

• bun run build
• bun run test (333 tests)
• Docker image builds successfully
• verified the runtime contains Elysia 1.4.29 and contains neither prool nor tar 7.2.0

[LukeHackett12]

Consolidated into #19 as requested. The runtime hardening and dependency fixes are now on that branch.