ci(406): apply the memory-swap rule to our own two sites; stop leaning on the peak reading [decisions-edit]

Re-review of the fix commits came back MERGEABLE with three findings worth acting on.

MEDIUM -- the PR documented a standing rule ("--memory without --memory-swap silently
grants 2x in swap") and then didn't apply it to the two sites this repo owns:
docker-build.yml's smoke container and scripts/migration-smoke.sh, both `--memory 2g` with
no --memory-swap. Pre-existing rather than a regression, but a rule you don't follow in
your own repo isn't a rule. The migration-smoke one matters most: it runs on the PROD host
in the release path, so a runaway migration should die against its cap rather than quietly
swap out the box serving media.

LOW -- and this is the important one: the docs leaned "peak 8305 MiB is probably mostly
reclaimable cache". An independent probe (full solution build, same CI image, shared
compilation off) measured peak 9457 MiB / anon 7134 MiB / file 421 MiB. ANON DOMINATED.
Having verified the *mechanism* (peak overstates because it counts page cache), I guessed
the *magnitude* in the direction I preferred -- the exact failure this entry criticises,
committed inside the entry criticising it. Corrected in ci-cd.md, decisions.md and on
server-management#604 (where the previous comment could have led to an unsafe 6g cap).

Consequences now recorded honestly: a 6g cap looks UNSAFE, #570's "6g proved too tight" is
the rule not an outlier, and #406's premise ("if this brings peak RSS well under 6 GiB the
whole budget loosens") is looking DEAD -- the 7134 MiB anon was measured with shared
compilation already off. The switches remain right; the looser budget they were meant to
buy does not follow.

NIT -- dropped the unverified claim that this also disables the Razor build server. The
UseRazorBuildServer -> UseSharedCompilation fallback is .NET 5-era; Razor has been an
in-process source generator since .NET 6, so there is likely no separate server to disable
on .NET 10. Unverified, zero impact, so it has no business in a doc arguing for
measurement over assumption.

[decisions-edit]: the touched docs/decisions.md lines were added by this PR's own earlier
commits, not settled entries on main -- net vs origin/main remains a pure insertion (0
deletions, verified). Also the sanctioned reason: the entry was factually wrong (see LOW).

Verified: both workflows parse; migration-smoke.sh passes bash -n; the parsed mysql option
string is `--memory=2g --memory-swap=2g --cpus=2`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/migration-smoke.sh

@@ -99,7 +99,12 @@ echo "migration-smoke: rehearsing $IMAGE ($IMG_ID)"
 # pending migrations on startup; it logs "Applying database migrations" then "Done applying database
 # migrations", and on failure the host stops (default BackgroundServiceExceptionBehavior = StopHost),
 # so the container exits. We gate PASS on the "Done" line, FAIL on early exit / a migration exception.
-docker run -d --name "$NAME" --memory 2g \
+# --memory-swap equal to --memory disables swap for this container. Without it Docker defaults
+# --memory-swap to 2x --memory, so `--memory 2g` alone silently grants 2g RAM + 2g of swap
+# (ersatztv#406). That matters here specifically: this smoke runs on the PROD host in the release
+# path, so a runaway migration should die loudly against its cap rather than quietly swap out the
+# box that is serving media.
+docker run -d --name "$NAME" --memory 2g --memory-swap 2g \
   -e ETV_CONFIG_FOLDER=/config \
   -e ETV_TRANSCODE_FOLDER=/tmp/etv/transcode \
   -v "$WORK/config:/config" \