fix(installer): mount soar flows dir in event-processor containers

[yllada]

What changed

installer/docker/compose.go now mounts <events-engine-workdir>/soar:/workdir/soar
in both event-processor-worker and event-processor-manager, the same way
rules/pipeline are already shared between the backend and the event
processor.

Why

SOAR flows created from the UI were never firing, with zero errors in any
log. Root cause: the backend writes flow YAML files into
<events-engine-workdir>/soar and that host dir was only bind-mounted into
the backend container — never into event-processor-worker or
event-processor-manager, where the com.utmstack.soar correlation plugin
actually runs.

[github-actions]

🛑 AI review — Sensitive area, extra care recommended

This PR touches critical paths or introduces changes the model cannot judge with sufficient confidence. Review carefully before merging.

🛑 architecture (gemini-3-flash-lite) — high/critical — please review

Summary: Changes detected in the installer module, which is a critical path requiring senior review.

• high installer/docker/compose.go:281 — Modification to the installer/ module. Changes to installer logic touch critical paths and require a Tier 3 review.

✅ bugs (gemini-3-flash-lite) — clean

Summary: Added Docker volume mounts for the soar working directory.

No findings.

🛑 security (gemini-3-flash-lite) — high/critical — please review

Summary: Docker volume creation uses overly permissive 0777 file permissions on workdirs.

• medium installer/docker/compose.go:281 — Directory creation using utils.MakeDir with 0777 permissions exposes the soar workdir to unauthorized read/write access by other local users on the host. Restrict permissions to 0700 or appropriate secure defaults.
• medium installer/docker/compose.go:326 — Directory creation using utils.MakeDir with 0777 permissions exposes the soar workdir to unauthorized read/write access by other local users on the host. Restrict permissions to 0700 or appropriate secure defaults.

🟢 go-deps — up to date

No pending Go dependency updates.