fix: tighten compose skill review findings

docker-compose/references/05-development-and-production.md

@@ -27,10 +27,10 @@ Run `docker compose up --watch` or `docker compose watch`. `sync` is for hot-rel
 ```bash
 docker compose build --pull
 docker compose config --quiet
-docker compose up -d --wait
+docker compose -p ci-${CI_JOB_ID:?CI_JOB_ID required} up -d --wait
-docker compose ps
+docker compose -p ci-${CI_JOB_ID:?CI_JOB_ID required} ps
-docker compose logs --no-color --tail=200
+docker compose -p ci-${CI_JOB_ID:?CI_JOB_ID required} logs --no-color --tail=200
-docker compose down --volumes --remove-orphans
+docker compose -p ci-${CI_JOB_ID:?CI_JOB_ID required} down --volumes --remove-orphans
 ```
 
 Use an isolated project name and deterministic image tags in CI. Do not use destructive volume cleanup against shared environments.

docker-compose/templates/.env.example

@@ -0,0 +1,4 @@
+# Compose interpolation inputs. Copy to .env or pass with --env-file.
+IMAGE_TAG=dev
+ADMINER_PORT=8080
+# Never put passwords or API keys here in a committed file.

docker-compose/templates/compose.yaml

@@ -29,7 +29,7 @@ services:
     networks: [app]
 
   adminer:
-    image: adminer:latest
+    image: adminer@sha256:983261ecc40a4aaf11e25aeda8ef821f5a43a9f024b3967c81cbcc0e6ce43ba3
     depends_on:
       db:
         condition: service_healthy