A hand-typed docker run omitted --memory, so a runaway job could OOM its
neighbours on the shared box; docker update only survives a restart, not a
rm+run redeploy. deploy/fourier.sh is the durable home for the cap: it
(re)launches both the API and worker containers with every flag baked in
(seccomp, env-file, /data volume, loopback port, restart policy, --memory,
default 3g each, overridable). Preflight refuses to launch under disk pressure.

DEPLOY.md §4 now points at the launcher. The host-venv worker.service unit is
marked superseded (the worker runs containerized on erable).