Two first-prod-stack-deploy findings: DuckDB extensions install to the
invoking user's ~/.duckdb, so the root-time httpfs bake left the uid-10001
lake unable to LOAD it (every /query 500'd); and the stack file never
disabled the image healthcheck for the daemon, so Swarm killed the healthy
gateway every ~100s (compose already disabled it). Bake now runs as the
runtime user; the stack matches compose. Prod mitigated live with
--no-healthcheck pending this landing.