ci: publish official aiofmp MCP server image to GHCR + tidy repo boundaries

[codemug]

Publish an official aiofmp MCP server image to GHCR + tidy repo boundaries

Makes the aiofmp MCP server available as an official, versioned container image on the GitHub
Container Registry, and corrects a repo-hygiene issue where trail's deployment artifacts were tracked
here while aiofmp's own container files were not.

Container image

• Track aiofmp's own container artifacts — Dockerfile, docker-compose.yaml, .dockerignore
  were untracked; they're now part of the repo.
• Publish-ready Dockerfile — adds OCI labels (org.opencontainers.image.source,
  description, licenses, version) so the GHCR package links back to this repo; a VERSION
  build-arg (CI stamps the release version, local builds default to dev); and a TCP HEALTHCHECK
  on the MCP port (FastMCP 406s a plain GET, so a socket connect is the right liveness signal).
• Verified: local multi-stage build succeeds, labels stamp correctly, entrypoint/healthcheck intact.

Release workflow (.github/workflows/docker-publish.yml)

• Builds multi-arch (linux/amd64 + linux/arm64) via Buildx/QEMU and pushes to
  ghcr.io/<owner>/aiofmp-mcp-server, tagged {version, latest}, with GHA layer caching +
  provenance/SBOM attestations.
• Trigger: primarily workflow_run after the Release workflow completes on main.
  semantic-release creates the vX.Y.Z tag using GITHUB_TOKEN, and GitHub does not re-fire
  push: tags workflows for token-pushed tags — so keying off the Release run is what makes
  "publish with every release" actually fire. Also runs on manual workflow_dispatch (optional
  version input, e.g. to backfill) and on direct v* tag pushes.
• Auth is GITHUB_TOKEN + packages: write — no PAT required.

Repo boundaries

• Stop tracking trail's deployment manifests — deploy/trail-mcp-full.yaml and
  deploy/Dockerfile.trail-mcp were committed here but belong with the trail project. They're
  untracked (git rm --cached) and deploy/ is gitignored. The files remain on disk for the live
  k3s deployment; they'll be relocated to the trail workspace separately.

Operational notes

• First push creates the GHCR package private under the owner; flip it to public in the package
  settings once. The image.source label auto-links it to this repo.
• The workflow_run trigger also fires on non-version-bumping main pushes (any successful Release
  run), harmlessly republishing the current version and moving latest.

Commit type

ci: — no library change, so semantic-release won't cut a version from this alone. The image
publishes on the next Release run (or immediately via workflow_dispatch).

🤖 Generated with Claude Code