fix(cv-import): bound source retention and guard worker recovery

tools/summarizer/Dockerfile.cv-import-dev

@@ -0,0 +1,18 @@
+# Isolated development image only. Supply an explicitly inspected existing runtime image ID.
+ARG CV_IMPORT_BASE_IMAGE=jobtracker-cv-import-legacy:required
+FROM ${CV_IMPORT_BASE_IMAGE}
+USER root
+COPY requirements-cv-import.lock /tmp/cv-import.lock
+COPY wheels/ /tmp/cv-import-wheels/
+RUN python -m venv /opt/cv-import && /opt/cv-import/bin/python -m pip install --no-index --find-links=/tmp/cv-import-wheels --require-hashes -r /tmp/cv-import.lock
+COPY app.py parser_child.py cv_import_ai.py /app/
+ENV CV_IMPORT_PYTHON=/opt/cv-import/bin/python \
+    CV_IMPORT_AI_ENABLED=false \
+    SKIP_MODEL_LOAD=1 \
+    AI_SERVICE_SKIP_MODEL_LOAD=1 \
+    HF_HUB_OFFLINE=1 \
+    TRANSFORMERS_OFFLINE=1 \
+    PYTHONDONTWRITEBYTECODE=1
+WORKDIR /app
+USER 10001
+CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "8001"]