feat(P03): docker release — multi-stage Dockerfile + Gitea container registry publish

REQ-046: Docker image published to Gitea container registry per release.

Dockerfile: multi-stage (golang:1.25 -> distroless/static-debian12:nonroot).
  CGO_ENABLED=0, ORCA_HOME=/var/lib/orca, ENTRYPOINT [/orca].
  Image size: ~28MB. Runs as nonroot.

.coreci.yml: new container-publish step in release pipeline (docker:24-cli,
  builds + tags + login + push + logout).

scripts/release.sh: docker build + push after Gitea release. Graceful
  skip if docker absent or GITEA_TOKEN unset. Env-overridable registry.

.dockerignore: excludes .git, bin/, .env, .ciagent/, testdata/, *.tar.gz.

docs/docker.md: pull, run, state persistence (volume mount), local build,
  manual publish guide.

Verified: docker build + run version/init with volume persistence.

---ci---
project: orca
phase: 3
milestone: v0.5
status: verify
---/ci---

.ciagent/CHECKPOINT.json

@@ -1,10 +1,10 @@
 {
-  "phase": 2,
-  "stage": "complete",
+  "phase": 3,
+  "stage": "verify",
   "milestone": "v0.5",
   "milestone_slug": "distribution",
   "phase_role": "execution",
   "attempts": 0,
-  "updated_at": "2026-08-03T18:55:00Z",
+  "updated_at": "2026-08-03T19:00:00Z",
   "milestone_complete": false
-}
+}