Release 0.1.0: MIT license, changelog, multi-arch Docker image without CLI builds

- LICENSE (MIT), CHANGELOG for 0.1.0, README overhaul
- docker-compose.release.yml pulling the registry image
- Dockerfile cross-compiles the server with cargo-zigbuild for amd64 and arm64;
  the terminal client is no longer built into the image
- Server, install script and settings point to a source install of the
  terminal client when no prebuilt binaries are available (/info: cli_builds)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker-compose.release.yml

@@ -0,0 +1,54 @@
+# CodeCraft from the published image (amd64 and arm64) – no build needed.
+#
+#   curl -fsSLO https://git.familie-zink.org/zink/codecraft/raw/branch/main/docker-compose.release.yml
+#   curl -fsSLO https://git.familie-zink.org/zink/codecraft/raw/branch/main/docker/seccomp-sandbox.json --create-dirs --output-dir docker
+#   curl -fsSL  https://git.familie-zink.org/zink/codecraft/raw/branch/main/.env.example -o .env   # then edit .env
+#   docker compose -f docker-compose.release.yml up -d
+#   docker compose -f docker-compose.release.yml logs codecraft   # one-time setup code for the first admin
+#
+# Update: docker compose -f docker-compose.release.yml pull && docker compose -f docker-compose.release.yml up -d
+#
+# Persistent state lives in the named volume "codecraft-data" (mounted at /data):
+#   /data/config.toml   configuration (also editable in the web UI)
+#   /data/codecraft.db  sessions, messages, statistics
+#   /data/backups       daily backups
+#   /data/home          home directory of the agent (git config, caches, ...)
+services:
+  codecraft:
+    # Pin a version (e.g. :0.1.0) or follow :latest.
+    image: git.familie-zink.org/zink/codecraft:${CODECRAFT_VERSION:-latest}
+    container_name: codecraft
+    restart: unless-stopped
+    # Same UID/GID as the owner of your project files.
+    user: "${UID:-1000}:${GID:-1000}"
+    # Bound to localhost by default: expose it through a TLS reverse proxy.
+    # Set BIND_ADDR=0.0.0.0 to publish it on all interfaces.
+    ports:
+      - "${BIND_ADDR:-127.0.0.1}:${PORT:-8787}:8787"
+    # All variables from .env are available to the config as ${NAME}
+    # (provider keys, MCP tokens, OIDC secret, initial admin).
+    env_file:
+      - path: .env
+        required: false
+    volumes:
+      - codecraft-data:/data
+      # The projects the agents may work on.
+      - ${WORKSPACE:-./workspace}:/workspace
+    # Reach self-hosted models (Ollama, vLLM, ...) on the host.
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    shm_size: "1gb" # Chromium (craft mode, browser tool)
+    # Shell commands of non-admin users run in a bubblewrap sandbox. It needs
+    # user namespaces: a seccomp profile that adds exactly those syscalls to
+    # Docker's default, AppArmor relaxed for the namespace mounts, and an
+    # unmasked /proc so the sandbox can mount its own (hiding server processes).
+    # Remove these three lines and set [sandbox] mode = "off" if you are the
+    # only user.
+    security_opt:
+      - seccomp=./docker/seccomp-sandbox.json
+      - apparmor=unconfined
+      - systempaths=unconfined
+
+volumes:
+  codecraft-data:
+    name: codecraft-data