feat: publish Rite container images and self-host docs (COD-425)

[shivros]

Summary

• Publish multi-architecture (linux/amd64, linux/arm64) Rite images to GHCR on v* tags.
• Document a loopback-bound Rite Docker run, including webhook-secret and optional Iris subscription configuration.
• Link to the Iris repository's reference Compose deployment.

Validation

• actionlint .github/workflows/release.yml — pass
• git diff --check — pass
• Rust build/test/clippy gates were not rerun: the host /tmp filesystem was full (ENOSPC) while compiling fresh disposable-worktree targets. This change does not alter Rust sources or generated artifacts.

Live GHCR publishing is intentionally deferred to the first release tag; this PR does not create a tag.

[shivros]

🤖 Automated Review Panel

GPT-5.6-terra

BLOCK (review-context transcription only): the supplied compacted review context represented tags as a single-quoted literal \n, which would be invalid metadata-action input. The actual committed workflows use a YAML block scalar with real line breaks; local actionlint passed both workflows. No remaining material finding against the committed diff.

---

Gemini 3 Flash

APPROVE. The tag trigger, least-privilege package publishing permissions, GHCR authentication, multi-architecture build, image tags, loopback-bound self-host commands, no-auth warning, and Iris–Rite Compose wiring align with COD-425. Compose configuration and workflow linting passed.

[shivros]

Auto-Merge Gate

Confidence: 0.90

Rationale: COD-425 clearly requires tag-triggered multi-architecture GHCR publication and self-host documentation for Rite. This focused two-file change fulfills the Rite slice: official Docker actions build and publish linux/amd64,linux/arm64 images on v* tags with scoped package-write permission; the README documents loopback binding, required webhook authentication, optional private Iris wiring, and the companion Compose deployment.

Checks observed: the CI test check succeeded; static workflow linting and git diff --check passed before opening. The review panel approved the committed diff.

Scope limits: No tag, release, live deployment, or live GHCR publishing was performed. First tag-push validation remains a separate acceptance step.