[deploy] No CI workflow builds Docker image — Dockerfile correctness not verified on push

[obchain]

PR: #55 (feat/27-docker-compose)
Files: .github/workflows/ (no new workflow added by this PR)

The PR introduces a multi-stage Dockerfile and compose stack but adds no CI step to verify the image builds. The test plan in the PR description explicitly defers docker compose up -d --build to the first deploy on the target host.

The workspace has a Rust CI gate (cargo build, cargo test, cargo clippy) and Foundry has forge build. The deploy layer has no equivalent. Breakage caused by a crate rename (COPY path no longer exists), a missing system package, or a cargo build --locked failure after a Cargo.lock update will only be discovered at deploy time on the production host.

Suggested fix: Add a .github/workflows/docker.yml (or extend an existing CI workflow) with a minimal build step:

- name: Build Docker image
  run: docker build --file Dockerfile --tag charon:ci .

No registry push is needed — build verification alone catches broken images. Trigger on changes to Dockerfile, Cargo.toml, Cargo.lock, or crates/**.

Refs #55

[obchain]

Fixed in 4f5ef7d — .github/workflows/docker.yml builds the image on pushes/PRs touching Dockerfile, Cargo.toml, Cargo.lock, or crates/**. Uses BuildKit with gha cache; no registry push.