fix: separate sync discovery from enrichment and harden Railway executor

Sync system was timing out because discovery endpoints (keyword, changes)
also ran schema extraction (~10-15s per tool). Now discovery is fast
(npm metadata + DB writes only) and a new /api/sync/enrich endpoint
handles schema extraction in time-budgeted chunks.

Railway executor was crashing without restarting due to unhandled promise
rejections, no restart policy, and no health checks. Added crash
protection, graceful shutdown, cache size limits, railway.toml with
ALWAYS restart policy, and upgraded Deno from 1.39 to 2.1.9.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/railway-executor/Dockerfile

@@ -1,9 +1,9 @@
-# Use official Deno image
-FROM denoland/deno:1.39.0
+# Use latest Deno LTS image for stability
+FROM denoland/deno:2.1.9
 
 # Install OpenSSH client for tools that need SSH access (e.g., exe-dev)
 USER root
-RUN apt-get update && apt-get install -y openssh-client && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y --no-install-recommends openssh-client curl && rm -rf /var/lib/apt/lists/*
 
 # Set working directory
 WORKDIR /app
@@ -19,5 +19,9 @@ RUN chmod +x start.sh
 # Expose port (Railway will set PORT env var)
 EXPOSE 3002
 
+# Docker-level health check as a fallback
+HEALTHCHECK --interval=30s --timeout=10s --start-period=15s --retries=3 \
+  CMD curl -f http://localhost:${PORT:-3002}/health || exit 1
+
 # Run startup script that fixes permissions then starts Deno as deno user
 CMD ["./start.sh"]