One reference deploy/docker-compose.yml; delete deploy/dev/

[qcentic-dev]

Part of #23. Spec: ADR 0016 — The 0.1.0 shape, clauses D40, D41.

Phase 2 — Images and container
Blocked by: #37, #39, #40
Blocks: #46, #52, #59

What

deploy/dev/ goes entirely — core.Dockerfile, core-provision.sh, core-provision.service, its compose and its README. Every file exists to fake a systemd machine so the tarball has somewhere to install, which is exactly the design being killed. Keeping it leaves that image in the repo as the thing newcomers copy.

#9's claim that nothing outside the tree references it is false — there are eight external references, one of which is the release path (container-image.yml:194,203). T8 must have landed first so there is a Core Dockerfile to point at.

One compose file, not two: no TLS terminator, and none coming. Operators bring their own nginx / Traefik / edge. The Panel speaks plain HTTP by design (ADR 0010 — "the Panel itself never grows certificate code"), so the reference's job is to name the port to point a proxy at. The Caddy + Let's Encrypt service is dropped.

This is the browser-facing edge only. The core-link's mTLS is untouched (ADR 0002) — that material is minted by the Core, travels in the registration blob, and is never something an operator supplies or renews.

Done when

• deploy/docker-compose.yml brings up a Panel and a Core that pair, from a clean checkout, in one command
• The Core publishes no host ports — only the Panel reaches it, over the compose network
• ACTANA_PUBLIC_HOST=core is a compose value in a file the operator edits, not baked into the image
• No privileged, no cgroup: host, no tmpfs, no init: — all four die with systemd, and tini is in the image
• core-home:/home/core is the only Core volume; the repos bind mount is present and commented as swappable for a named volume
• deploy/dev/ is gone and all eight external references are repointed: container-image.yml:174,179,194,203, panel-image.test.mjs:29,188, docs/images/core.md, README.md, CONTRIBUTING.md, docs/README.md, docs/ci-cd.md
• A second Core is a copy of the service block with a different name, host and volume — verified once, so the "nothing is singleton" claim is tested rather than asserted

---

_{Decisions are locked in ADR 0016. If this ticket needs one changed, amend the ADR in the same PR — do not decide it in a comment.}