Use registry-backed server image in production packages

[den-sq]

Summary

• add a production server resource generator that writes extra-resources/server/compose.yml with a GHCR image reference
• include server-image.json metadata for the exact repository/tag/digest used by a package
• update the app release workflow to prepare registry-backed server resources instead of bundling Python wheel/Dockerfile build inputs
• document tag and digest usage for release packaging

Verification

• node --check scripts/prepare-production-server.mjs
• OUROBOROS_SERVER_IMAGE_TAG=v9.9.9 npm run prepare:production-server
• inspected generated extra-resources/server/compose.yml
• inspected generated extra-resources/server/server-image.json

Closes #88.

[tavateva]

Draft Promotion Review ✅ READY

Reviewed against Draft Promotion Criteria.

Context: This PR addresses issue #88 (Use registry-backed server image in production packages).

Criterion Assessment

1. CI and mergeability: ✅ PASS — coverage and docs checks green, mergeable
2. Issue Acceptance Criteria: ✅ PASS — All 4 criteria met:
   • ✅ Production package includes compose with GHCR image reference
   • ✅ First launch pulls image (no build: in generated compose)
   • ✅ Development compose unchanged (still builds from source)
   • ✅ Documentation updated (registry-server-images.md)
3. PR body Test Plan checkboxes: ✅ PASS — All verification items executed:
   • ✅ node --check scripts/prepare-production-server.mjs
   • ✅ npm run prepare:production-server with test tag
   • ✅ Generated extra-resources/server/compose.yml inspected
   • ✅ Generated extra-resources/server/server-image.json inspected
4. Tests run: ✅ PASS — Script validation and output inspection reported
5. Scope: ✅ PASS — Focused on registry image integration; removed wheel/Dockerfile bundling from release workflow
6. Regressions: ✅ PASS — CI green; generated compose preserves ports/volumes/environment
7. Judgement calls: ✅ PASS — Image tag/digest defaulting logic documented inline in script

VERDICT: ✅ READY TO MERGE

Key Changes

• scripts/prepare-production-server.mjs: Generates registry-backed compose.yml from env vars
• Release workflow: Replaced Python/Poetry steps with npm run prepare:production-server
• Compose output: Uses image: ghcr.io/chenglabresearch/ouroboros-server:<tag> instead of build:
• Metadata: server-image.json tracks exact image/tag/digest/commit for package

All 7 criteria satisfied. This PR closes issue #88 and is ready to merge.