Publish the native release as a container image and document deployment

A static nginx image (unprivileged, read-only) of the production build,
published to Gitea's registry for amd64 and arm64: version tags go to
prod, manual dev-<commit> builds to dev, each smoke-tested first and
optionally announced to Dockhand. The README describes running it with
Docker Compose.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.dockerignore

@@ -0,0 +1,26 @@
+# Only the native application's build inputs may reach the Docker daemon.
+**
+!package.json
+!package-lock.json
+!tsconfig.json
+!vite.config.ts
+!index.html
+!src/
+!src/**
+!public/
+!public/**
+!scripts/
+!scripts/service-worker.mjs
+!scripts/check-release.mjs
+!deploy/
+!deploy/nginx.conf
+
+# Also exclude private data accidentally placed inside an allowed directory.
+**/*.gb
+**/*.gbc
+**/*.rom
+**/*.sav
+**/*.crystal-save.json
+**/.env*
+**/node_modules
+**/.git