The --ignore-scripts enforcement in the base stage is the detail I'd highlight most, supply-chain attacks via postinstall hooks are exactly the kind of thing that's easy to know about and easy to forget to actually block in every project, baking it into the skill rather than relying on each dev remembering it is the right place to fix it.

The split compose topology also solves a real pain point, I've seen plenty of "production" configs that were secretly still running dev volume mounts because nobody cleaned them out after local testing. Structural separation beats "remember not to do that."

Curious how the ephemeral runner pattern handles test flakiness that depends on container state bleeding between runs, if a test suite has subtle order-dependent bugs, does spinning up fresh containers every time actually surface those faster, or does it mask them by always starting clean?