Publish the native release as a container image and document deployment

A static nginx image (unprivileged, read-only) of the production build,
published to Gitea's registry for amd64 and arm64: version tags go to
prod, manual dev-<commit> builds to dev, each smoke-tested first and
optionally announced to Dockhand. The README describes running it with
Docker Compose.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

compose.yaml

@@ -0,0 +1,13 @@
+services:
+  crystal:
+    image: git.azuze.fr/kawa/crystal:${CRYSTAL_TAG:?Set CRYSTAL_TAG to a published image tag}
+    ports:
+      - "127.0.0.1:${CRYSTAL_PORT:-8080}:8080"
+    restart: unless-stopped
+    read_only: true
+    tmpfs:
+      - /tmp
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true