test(security): rebuild local Compose loopback RED on live develop

[seonghobae]

Replacement execution lane for #180 from exact live protected develop@106add38465937f6eb4e4accc185fd30aab4446f. Stale-base PR #279 remains historical until exact source preservation is rechecked.

Exact current test-only head 3b5623c88ec134fb628da1997492c63af41f64bf adds only LocalComposeLoopbackBindingTest. It exercises the shipped root docker-compose.yml and requires every default published host port to bind explicitly to 127.0.0.1. Protected source still publishes ports without a host address, so valid hosted RED must be the loopback assertion after normal compilation/test startup; path/setup/fixture failure is not valid RED.

No Compose production mutation is included. Active #167 still owns the Zipkin docker-compose.yml transport boundary, so keep this Draft test-only until that source lane integrates/closes or yields a stable non-racing exact parent. Loopback binding is defense in depth for the local profile and does not substitute for #161 service authentication, #185 registry identity, TLS, or a production deployment security profile. Shared exact-source, non-vacuous coverage, dependency/security, governance and independent-review gates remain separate.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: db1e46d4-67e2-4d75-881a-7130cea7d386

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}