chore(docker): env2 runs its own image tag, leader-auto-down overlay, drill targets env2 (#116)

- docker/build.sh: SCADABRIDGE_IMAGE picks the tag (default scadabridge:latest).
- docker-env2/docker-compose.yml: node image is ${SCADABRIDGE_IMAGE:-scadabridge:latest},
  so env2 can run its own build without retagging the primary rig's image.
- docker-env2/docker-compose.leader-auto-down.yml: opt-in overlay for both env2 pairs,
  mirroring docker/docker-compose.leader-auto-down.yml. Shipped default stays auto-down.
- docker/failover-drill.sh: DRILL_ENV=primary|env2 (container prefix, Traefik :9100,
  pair site-x).

Claude-Session: https://claude.ai/code/session_01GT67ACmpMR7b9LGRPLijMi

docker-env2/docker-compose.yml

@@ -8,9 +8,13 @@
 x-secrets-store-env: &secrets-store-env
   Secrets__SqlitePath: "/data/scadabridge-secrets.db"
 
+# Node image: ${SCADABRIDGE_IMAGE:-scadabridge:latest}. Unset = the primary rig's shared
+# image (the historic behaviour). Set SCADABRIDGE_IMAGE (same variable docker/build.sh
+# tags with) to run env2 on its own build, e.g. SCADABRIDGE_IMAGE=scadabridge:env2-116,
+# so an env2 rebuild never retags the image the primary rig's containers run.
 services:
   central-a:
-    image: scadabridge:latest
+    image: ${SCADABRIDGE_IMAGE:-scadabridge:latest}
     # An init process (tini) as PID 1, so a crashed dotnet process actually dies
     # instead of wedging the container at 100% CPU with the restart policy never
     # firing — mirrors docker/docker-compose.yml's init: true (ScadaBridge#34).
@@ -75,7 +79,7 @@ services:
     restart: unless-stopped
 
   central-b:
-    image: scadabridge:latest
+    image: ${SCADABRIDGE_IMAGE:-scadabridge:latest}
     init: true  # PID-1 crash wedge, ScadaBridge#34 — see central-a
     # CoordinatedShutdown needs cluster-leave (15s budget) + cluster-exiting +
     # actor-system-terminate + Serilog flush; the 10s SIGTERM default SIGKILLed
@@ -137,7 +141,7 @@ services:
     restart: unless-stopped
 
   site-x-a:
-    image: scadabridge:latest
+    image: ${SCADABRIDGE_IMAGE:-scadabridge:latest}
     init: true  # PID-1 crash wedge, ScadaBridge#34 — see central-a
     # CoordinatedShutdown needs cluster-leave (15s budget) + cluster-exiting +
     # actor-system-terminate + Serilog flush; the 10s SIGTERM default SIGKILLed
@@ -166,7 +170,7 @@ services:
     restart: unless-stopped
 
   site-x-b:
-    image: scadabridge:latest
+    image: ${SCADABRIDGE_IMAGE:-scadabridge:latest}
     init: true  # PID-1 crash wedge, ScadaBridge#34 — see central-a
     # CoordinatedShutdown needs cluster-leave (15s budget) + cluster-exiting +
     # actor-system-terminate + Serilog flush; the 10s SIGTERM default SIGKILLed