fix(runtime): tesseract languages + raise nsjail memory limit

Two fixes surfaced during PDF skill testing:

1. tesseract-ocr-{fra,deu,spa,ita}: the base tesseract-ocr package only
   ships English. OCR on French/German/Spanish/Italian PDFs needs the
   language packs installed in the image (pytesseract.image_to_string
   accepts lang="fra+eng" but cannot use a language that isn't present).
   Added to the existing apt install layer.

2. rlimit_as 512 → 1024 MiB: 512 MiB is too tight for PDF OCR workflows
   (pdf2image renders pages at 200+ DPI which can momentarily allocate
   400-700 MiB per page; tesseract on top adds 100-200 MiB working set).
   Skill consistently OOM-killed at 512 MiB even with del+gc.collect()
   between pages. 1024 MiB is sufficient with page-by-page processing
   and remains conservative for the trusted-tenant model.

Author: Damien

Dockerfile

@@ -48,7 +48,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     libjpeg-dev libpng-dev libtiff-dev libopenjp2-7-dev \
     libfreetype6-dev liblcms2-dev libwebp-dev \
     tcl8.6-dev tk8.6-dev \
-    poppler-utils tesseract-ocr pandoc \
+    poppler-utils tesseract-ocr tesseract-ocr-fra tesseract-ocr-deu \
+    tesseract-ocr-spa tesseract-ocr-ita pandoc \
     portaudio19-dev flac ffmpeg \
     libpulse-dev libsdl2-dev libsdl2-mixer-dev libsdl2-image-dev libsdl2-ttf-dev \
     antiword unrtf \

docker/nsjail-base.cfg

@@ -29,7 +29,7 @@ clone_newcgroup: true
 
 # Virtual memory limit (MB) — matches HARD rlimit
 rlimit_as_type: HARD
-rlimit_as: 512
+rlimit_as: 1024
 
 # Max output file size (MB)
 rlimit_fsize: 100