[michael-elkabetz]

Self-hosting currently requires Git, host Node.js, a source checkout, and a local application build. This change makes the production path a downloaded deployment bundle plus Docker Compose, with unique secrets generated inside the application image.

• Use a version-pinned GHCR image for web, migrations, and maintenance; preserve the existing project, database, and volume identities. Keep source builds in a separate Compose override.
• Publish the exact tested AMD64 and ARM64 images and matching deployment archive/checksum from version tags. Prereleases stay separate from latest.
• Update the README and in-app installation instructions, and document HTTPS, upgrades, coordinated backups, recovery, and the one-time public GHCR package setting.
• Add native Docker lifecycle CI, including upgrades from the PR base image, publishing, password verification, persistence, backup/restore, runtime origins, maintenance, and failed-migration startup gating.

Validation: npm run release:check (21 tests, typecheck, lint, formatting, production build); 51 API integration checks plus shared-domain integration; skill installation checks; actionlint and shell syntax validation; local ARM64 Docker build; full lifecycle and upgrade from current main under Compose v5.1.1 and v2.38.1. All GitHub checks now pass, including the lifecycle on native AMD64 and ARM64.

Release coordination: the default deployment pins 0.1.0. Publish the tested v0.1.0 tag and verify anonymous GHCR pulls before promoting these installation instructions. No existing deployment or user data is modified by this PR.

[mike-elkabetz]

looks good