[Security] Make the Open Design Docker adapter safe by default on the network

[juancarlosrodicio]

Problem

The Docker adapter exposes Open Design on every host interface by default:

• `docker/open-design/docker-compose.yml:5-10` publishes `7456:7456` and defaults `OD_HOST` to `0.0.0.0`.
• `docker/open-design/Dockerfile:40-50` also defaults the daemon to `0.0.0.0` and starts it without an authentication layer.
• The compose file mounts `./opencode-auth` read-write and the Open Design agent can operate on the mounted workspace.

The security documentation warns operators not to expose the service publicly, but the shipped deployment still makes a network-reachable service the default.

Impact

A client that can reach port 7456 may be able to submit work to the agent service, consume the configured provider credentials and budget, or cause changes in the mounted Open Design workspace. A mistaken LAN/public deployment therefore has a large blast radius.

Suggested direction

• Bind to `127.0.0.1` by default; make LAN exposure an explicit opt-in profile.
• Add an authentication/TLS boundary for non-local deployments, or fail closed when one is not configured.
• Prefer read-only auth mounts where supported.
• Add container hardening such as a read-only root filesystem, dropped capabilities, and `no-new-privileges` where compatible.
• Update the security documentation and add a compose/configuration smoke test for the safe default.

Acceptance criteria

1. The default `docker compose up` is reachable only from the local machine.
2. LAN/VPN exposure requires an explicit, documented configuration and an authentication boundary.
3. The default configuration cannot expose provider auth or workspace mutation to an unauthenticated remote caller.
4. CI or a static test prevents accidental reintroduction of an all-interface unauthenticated default.