feat: release pipeline, Dockerfile, and deployment docs

[rado0x54]

Summary

Closes #40

• Dockerfile: Multi-stage build (deps → build → runtime) using Node 24 bookworm-slim, non-root user, HEALTHCHECK
• Release workflow: Docker build+push on develop/main, crane retag on v* tags (no rebuild), standalone tarball + GitHub Release with auto-generated changelog committed to main
• Agent release workflow: Go cross-compile (linux/darwin × amd64/arm64) on agent/v* tags, GitHub Release + changelog
• docker-compose.yml: Quick-start with volume mounts for data, keys, config
• Deployment docs: Docker, standalone tarball, and agent client installation

Docker tag strategy

Trigger	Tags
Push to develop	:develop, :sha-<short>
Push to main	:stable, :sha-<short>
Tag v1.2.3	:1.2.3, :1.2, :latest (retag, no rebuild)

Test plan

• Docker image builds locally (docker build -t shellwatch:local .)
• Container starts and /health returns {"status":"ok"}
• HEALTHCHECK instruction registered
• CI workflow_call works when release.yml triggers
• Docker push to GHCR on develop/main
• Retag flow on version tag
• Agent cross-compile on agent/v* tag