Keep testing helpers out of production builds

[lucarlig]

Production Docker images currently include unauthenticated token, JWKS, and user-config helpers. Build with plugins and omit with_tools while retaining the always-available health endpoint introduced in #136. This covers make docker-prod, the image publishing workflow, and the CI binary used for conformance.

Use cf-integration 0.3.2 for conformance. Its harness owns ephemeral JWT signing, loopback JWKS, and Redis fixture publication, so the same production feature selection works for both local and CI tests. Remove the separate with_tools image workaround. The dev-tools change is contextforge-org/contextforge-dev-tools#14.

Compose uses the issuer's JWKS URL instead of mounting test signing keys into dataplane containers. The README and wiki document production commands, harness setup, and with_tools as testing-only.

Validation:

• Production image load test: 41 authenticated MCP requests, zero failures.
• Modern conformance: all 84 existing server/client baseline outcomes matched, including an installed-binary run with embedded assets; no unexpected failures or passes.
• Production/testing image smoke checks: health GET/HEAD, POST rejection, MCP authentication, production helper routes absent, and testing helper routes available.
• 247 workspace tests passed (13 skipped); formatting, Clippy, build, deny, and shear passed. The updated CI build command also passes without with_tools.
• Wiki build/tests, Compose configuration, package verification, and Make recipe checks passed.