feat(P03): docker release — multi-stage Dockerfile + Gitea container registry publish
REQ-046: Docker image published to Gitea container registry per release.
Dockerfile: multi-stage (golang:1.25 -> distroless/static-debian12:nonroot).
CGO_ENABLED=0, ORCA_HOME=/var/lib/orca, ENTRYPOINT [/orca].
Image size: ~28MB. Runs as nonroot.
.coreci.yml: new container-publish step in release pipeline (docker:24-cli,
builds + tags + login + push + logout).
scripts/release.sh: docker build + push after Gitea release. Graceful
skip if docker absent or GITEA_TOKEN unset. Env-overridable registry.
.dockerignore: excludes .git, bin/, .env, .ciagent/, testdata/, *.tar.gz.
docs/docker.md: pull, run, state persistence (volume mount), local build,
manual publish guide.
Verified: docker build + run version/init with volume persistence.
---ci---
project: orca
phase: 3
milestone: v0.5
status: verify
---/ci---
Jon Chery
de8fdc0fe4