#1756 Make official Docker image OCI-compliant

Problem

The current Dockerfile is a minimal 5-liner that produces a working image but doesn't follow OCI image spec conventions. The platform-swamp deployment Dockerfile (deployments/swamp-serve/Dockerfile) already does some of this (e.g. org.opencontainers.image.revision label), but the main swamp image has none of it.

Proposed Solution

Bring the official Dockerfile up to OCI best practices:

1. OCI labels — add standard org.opencontainers.image.* labels (revision, version, source, created, title, description, vendor, licenses)
2. Non-root user — run as a non-root user by default for security
3. Signal handling — ensure proper STOPSIGNAL / SIGTERM handling
4. HEALTHCHECK — if applicable for swamp serve usage

The platform-swamp deployments/swamp-serve/Dockerfile can serve as a reference for some of these (it already sets the revision label and installs supporting packages).

Alternatives

• Keep the Dockerfile minimal and leave OCI compliance to downstream consumers — but since this is the official image, it should set the standard.