Two corrections layered on top of the prior commit:
1. Shell-docs needed the same env var declared in the RUNTIME stage,
not just the builder. Next.js encrypts Server Action references at
build time but DECRYPTS incoming Server Action requests at runtime
using the same key. Declaring the ENV in the runner stage (with an
empty default that Railway overrides at container start) makes the
variable unambiguously available to `next start` regardless of
Railway env-injection quirks.
2. Showcase/shell has the same Next 16.x vulnerability and was missed
in the original implementation. Mirror the build-arg flag + the
Dockerfile ARG/ENV plumbing into shell's pipeline so both services
get the fix together. Closes the sibling-ticket scope into one PR.
Refs PDX-202, folds PDX-204.
Sam Julien
ee29dab8b1