v1.0: server-ready — GHCR image, PUID/PGID, pull install, compose

[BrettKinny]

Makes squarebox a first-class citizen on servers / VPS / Unraid for the v1.0 push, while keeping the desktop install path behaviour-identical (default PUID/PGID=1000 ⇒ the new root→setpriv→dev entrypoint is a no-op equivalent to the old USER dev).

What's in here (items 1–5, 7 from the planning session)

• 1 — GHCR multi-arch publish, gated on E2E. e2e.yml gains a publish job that needs every test job and only runs on v* tags, so a tag can never publish a broken image or advertise a release for one. It pushes ghcr.io/squarewavesystems/squarebox:<ver> (+ :latest for stable) for linux/amd64,linux/arm64 and creates the GitHub release with install.sh/install.ps1/uninstall.sh. The old ungated release.yml is removed. build.yml gains an arm64 build smoke at PR time.
• 2 — Pull, don't build. install.sh pulls the prebuilt image by default (no local Docker build / toolchain); --build / --edge build from source. It still clones the repo for config + the sqrbx helpers (git is already a prereq), so all existing bind-mount / shell-init logic is reused unchanged.
• 3 — PUID/PGID. New scripts/squarebox-entrypoint.sh remaps dev to PUID/PGID via setpriv then drops privileges; honours Unraid's 99:100. Existing hardened cap set already covers the remap.
• 4 — Install-dir overrides. SQUAREBOX_DIR / SQUAREBOX_WORKSPACE for durable installs where $HOME is volatile (Unraid /root tmpfs).
• 5 — docker-compose.yml + .env.example for long-lived server / NAS use (named volume, restart: unless-stopped, mirrored cap set, -u dev exec).
• 7 — Non-interactive provisioning. SQUAREBOX_AI/SDKS/EDITORS/TUIS/MULTIPLEXERS (+ SQUAREBOX_GIT_NAME/EMAIL) pre-seed the existing /workspace/.squarebox config files and run a one-off setup — reusing the contract devcontainer-postcreate.sh (fix(devcontainer): open the cloned repo and install a default toolset #85) already established. No setup.sh changes needed.

Validation done locally (amd64, docker 29.5.1)

• Default → uid=1000(dev); PUID=99 PGID=100 → uid=99 gid=100(users), /workspace writes owned 99:100.
• Interactive-login aliases resolve (eza/bat), DEVCONTAINER=1 skips setup, /home/dev + /workspace writes persist — i.e. the assertions build.yml/e2e.yml make still hold through the new entrypoint.
• arm64 build + full behavioural matrix run in CI (this PR's build-arm64, and the tag's E2E).

Follow-ups (not in this PR)

• install.ps1 still builds locally (Windows isn't the server target); pull-mode for it is a later change.
• After the first publish, the GHCR package must be flipped to public in org settings for anonymous docker pull.

🤖 Generated with Claude Code