feat: v1.4.0 — prebuilt smart Docker image

[notabotchef]

Summary

Phase 2 of setup-friction-fix: cut install time from ~15 min + 6 manual steps to <2 min + 1 step.

• Prebuilt Docker image — ghcr.io/notabotchef/phantom-bridge:latest. x11vnc, novnc, xvfb, xdotool, chromium, websockets, cryptography all pre-installed. No apt-get, no pip install, no execute.py step.
• Smart entrypoint (docker-entrypoint-phantom.sh) — detects whether the user has a git clone'd plugin mounted. If bridge.py exists at start, leaves it alone (preserves git pull workflow). If not, copies from /opt/phantom_bridge_baked/ via cp -rn (no overwrite, skips data/).
• Drop-in compose override (docker-compose.override.yml) — drops next to the user's existing docker-compose.yml; Compose auto-merges. Never mutates the original. PHANTOM_NOVNC_PORT env var for port collision.
• GitHub Actions publish pipeline — .github/workflows/docker-publish.yml builds amd64 + arm64 via buildx on v* tag and main branch push. Publishes to ghcr.io with packages: write.
• README Quick Start — leads with 3-command Docker path; manual install preserved below as fallback.
• Phase 1 dependency — uses bridge_doctor --quiet from v1.3.0 in the HEALTHCHECK directive.

Why

Discussion #146: "hard setup". Manual flow had too many failure surfaces (apt, pip, port mapping, profile sharing, execute.py) — each one bricks the install if anything's off.

Test plan

• python -m pytest tests/test_probe_novnc.py — 7/7 pass (no regression from v1.3.0)
• bash -n install of all new shell files — clean
• Compose override valid YAML
• Deferred to user (no local Docker on autopilot host): docker build -t pb-test . to verify image builds, smart entrypoint runs on a fresh frdel/agent-zero-run:latest container
• First v1.4.0 tag push will exercise docker-publish.yml end-to-end

Files

• Dockerfile — apt + pip layered, baked plugin at /opt/phantom_bridge_baked/, HEALTHCHECK uses bridge_doctor --quiet
• docker-entrypoint-phantom.sh — cp -rn smart copy, chains to /exe/run_a0.sh
• docker-compose.override.yml — drop-in
• .dockerignore — excludes data/, .git/, tests/
• .github/workflows/docker-publish.yml — multi-arch buildx + ghcr push
• README.md — Quick Start section
• plugin.yaml — version 1.4.0

Phase 2 of 3 in .rune/plan-setup-friction-fix.md. Depends on #1 (v1.3.0). v1.4.1 (one-liner installer) follows.

[notabotchef]

Smart entrypoint logic looks solid — the cp -rn + bridge.py existence check means git pull users don't get their changes shadowed. Need to verify the multi-arch build on first tag push though.