v0.2.1 — community Compose and GHCR bootstrap

Community Docker Compose deployment with mandatory fresh Bitwarden/Vaultwarden credentials at every execution.

• Pull a versioned GHCR image for amd64 or arm64; local builds and host Python are contributor workflows.
• Configure a dedicated vault account, API credentials, master password and exact Login item UUID. Direct DEGIRO credential environment variables are rejected.
• Follow the root README for Ghostfolio authentication, discovery, mapping, persistent state permissions, DRY_RUN review and scheduling.
• Failed scheduled runs, including DRY_RUN, alert through optional Apprise; successful runs remain silent.
• Upstream release/source watches open review issues without changing versions or deploying.
• Remove personal deployment material and fix the CodeQL logging regression without weakening privacy coverage.

Breaking configuration change: migrate to the documented BW_* variables before upgrading. Keep DRY_RUN=1 until the proposal is reviewed. Preserve mapping and state volumes; record the previous image digest and restore that digest for rollback. No production deployment or financial mutation is included in this release.

Validation: 1,462 offline tests and native amd64/arm64 container CI passed. PR #48 has a completed CodeRabbit review covering 9bf20db and passed the guarded merge. PR #45 was merged separately by the maintainer with an explicit CodeRabbit override. The release workflow gates image publication with security scans, native smoke checks, a synthetic community journey, SBOM and provenance. Registry publication is tracked separately from source release publication.

Packaging correction: authenticate before the package exists, publish checked images by digest, then strictly verify version-tag absence before publishing the multiarchitecture manifest. First v0.2.0 image publication failed before any images were published; its source tag remains immutable. Failure diagnostics reveal only the phase and HTTP status.