feat(docker): expose DASHBOARD_ALLOW_EMBED as a build argument

The dashboard's frame-ancestors policy is compiled into the route manifest at
build time, so the only way to get an embed-enabled image was to edit the
Dockerfile: Docker silently drops a --build-arg with no matching ARG, so
`docker build --build-arg DASHBOARD_ALLOW_EMBED=vscode` produced the default
image and no error.

Declared as ARG+ENV in the builder stage, mirroring OMNIROUTE_BASE_PATH, and
empty by default — the unframable default posture is unchanged. The runtime
stages deliberately do not carry it: the headers are already baked, so a
runtime value would advertise an effect it cannot have.

Guarded by tests/unit/dockerfile-dashboard-embed-arg-10273.test.ts, verified by
mutation (a bare ENV in place of the ARG fails 2 of the 3 assertions). Docs
updated across the guide, ENVIRONMENT.md and .env.example.

The guide also carries prettier normalization (emphasis markers, table
padding) applied by lint-staged on commit.

Refs #10273

.env.example

@@ -143,6 +143,8 @@ PORT=20128
 # (/api, /v1, /v1beta, /a2a, /healthz and the root-level aliases) keeps the strict
 # headers regardless. Only `vscode` is recognised; `1`/`true` do NOT enable it.
 # Used by: next.config.mjs via scripts/build/dashboardEmbed.mjs — build-time, rebuild after changing.
+# Docker: pass it as a build arg (`docker build --build-arg DASHBOARD_ALLOW_EMBED=vscode`);
+# setting it on an already-built server or image does nothing.
 # DASHBOARD_ALLOW_EMBED=vscode
 
 # Split-port mode: serve Dashboard and API on separate ports for network isolation.