fix(stand): bounded logs + restart policies + Flink failure-rate restart budget (P2.1-P2.3)

[brownjuly2003-code]

Makes the 2026-07-18 soak remediation permanent in the repo instead of living only in the Mac host's daemon.json, and bounds Flink's restart behavior.

• P2.1 — log rotation: x-logging anchor (json-file, max-size: 50m, max-file: 3) on every service in all seven docker-compose*.yml. Root cause of the failed 4h soak was the stand disk filling with unrotated container logs (TM alone 3.8G).
• P2.2 — restart policy: restart: unless-stopped on flink-jobmanager/flink-taskmanager in docker-compose.flink.yml. One-shot provision jobs (kafka-init, minio-init, flink-job-runner) deliberately keep the default no — restarting a completed job-runner would resubmit the Flink job.
• P2.3 — bounded restart strategy: RestartStrategies.failure_rate_restart(3, 5min, 10s) (env-overridable) in both jobs' build_pipeline. With the default infinite fixed-delay strategy, a job whose environment is persistently broken restarts forever and re-emits from the last checkpoint each attempt (soak r1: 116 restarts → 292k duplicate events downstream). Now it parks in FAILED where alerting takes over.

Verification: all compose files re-parsed with anchors resolved (every service carries the exact logging config); tests/unit 2026 passed locally including new restart-strategy assertions for both jobs; ruff check + format clean.

Live docker kill TM → auto-restart check needs the Mac stand (currently powered down) — the flink-smoke CI lane exercises the merged compose config.

🤖 Generated with Claude Code

[github-actions]

DORA Metrics

• Window: last 30 days
• Branch: main
• Deployment frequency: 112 total / 26.13 per week
• Lead time for changes: avg 0.6h / median 0.0h
• Change failure rate: 75.89% (85/112)
• MTTR: 20.13h across 5 incident(s)

[brownjuly2003-code]

Do not merge yet — P2.3 will fail on the real runtime.

The runtime is apache-flink 2.3.0 (pinned in src/processing/flink_jobs/requirements.txt, asserted in the Dockerfile). In Flink 2.x StreamExecutionEnvironment.set_restart_strategy was removed (FLIP-381) — verified against release-2.3.0 sources: pyflink/common/restart_strategy.py still exists, but the env method is gone, so build_pipeline() raises AttributeError at submission. Unit tests pass because the fixture fakes the env; expect flink-smoke on this PR to fail — that failure is this, not the compose changes.

Fix recipe (small): replace env.set_restart_strategy(RestartStrategies.failure_rate_restart(...)) in both jobs with the Flink 2.x config route, which release-2.3.0 supports (def configure(self, configuration: Configuration) at stream_execution_environment.py:379):

from pyflink.common import Configuration

config = Configuration()
config.set_string("restart-strategy.type", "failure-rate")
config.set_string("restart-strategy.failure-rate.max-failures-per-interval", os.getenv("FLINK_RESTART_MAX_FAILURES_PER_INTERVAL", "3"))
config.set_string("restart-strategy.failure-rate.failure-rate-interval", "5 min")   # env-overridable likewise
config.set_string("restart-strategy.failure-rate.delay", "10 s")
env.configure(config)

and update the two test fixtures to fake pyflink.common.Configuration + capture env.configure instead of set_restart_strategy. P2.1/P2.2 (compose logging/restart) are unaffected.