TypeScript Dockerfiles (filesystem, memory, sequentialthinking) ignore the workspace lockfile and overrides #5345

Problem

The Dockerfiles for filesystem, memory and sequentialthinking build (since #5147 moved them to node:24-alpine, see #4782), but they do not install what this repository tested:

• The workspace lockfile and overrides are ignored. Each builder stage copies src/<server> alone and runs a lockfile-less npm install, which resolves every dependency fresh on the day of the build. The root package-lock.json and the root package.json overrides (the pins for transitive advisories: qs, hono, proxy-addr, ip-address, …) never reach the image. Example from the everything image built the same way: it installed qs@6.17.0, where the lockfile has 6.16.0.
• --omit-dev is not an npm flag. npm ci --ignore-scripts --omit-dev prints npm warn Unknown cli config "--omit-dev"; dev dependencies are left out only because NODE_ENV=production is set. The flag is --omit=dev.
• They run as root (the TypeScript half of Dockerfiles for fetch/git/time create an app user (since #2205) but never switch to it; all seven images run as root #4741, which covers the Python images).

Reproduce

docker build -f src/filesystem/Dockerfile -t fs-check . 2>&1 | grep -E 'omit-dev|added'

Expected

Each image installs from the root lockfile with npm ci --workspace src/<server>, building from the repository root as context, with a src/<server>/Dockerfile.dockerignore allow-list. #3309's PR does this for everything (src/everything/Dockerfile); the same shape applies to the other three. Out of scope for #3309, which concerns everything only.