Roadmap: offline release bundle for closed-contour installs

[ykshv]

Goal

Package Rula for a reproducible closed-contour install without ad hoc internet access at runtime.

Scope

• Pin container images and dependency versions.
• Define an offline dependency mirror strategy.
• Produce model/container checksum manifests.
• Document what must be downloaded before entering the closed contour.

Acceptance

• A clean install path exists for a target host with outbound network blocked after artifact staging.
• Model weights, generated media, secrets, and local runtime state remain outside Git.