feat(P03): docker release — multi-stage Dockerfile + Gitea container registry publish

REQ-046: Docker image published to Gitea container registry per release.

Dockerfile: multi-stage (golang:1.25 -> distroless/static-debian12:nonroot).
  CGO_ENABLED=0, ORCA_HOME=/var/lib/orca, ENTRYPOINT [/orca].
  Image size: ~28MB. Runs as nonroot.

.coreci.yml: new container-publish step in release pipeline (docker:24-cli,
  builds + tags + login + push + logout).

scripts/release.sh: docker build + push after Gitea release. Graceful
  skip if docker absent or GITEA_TOKEN unset. Env-overridable registry.

.dockerignore: excludes .git, bin/, .env, .ciagent/, testdata/, *.tar.gz.

docs/docker.md: pull, run, state persistence (volume mount), local build,
  manual publish guide.

Verified: docker build + run version/init with volume persistence.

---ci---
project: orca
phase: 3
milestone: v0.5
status: verify
---/ci---

.coreci.yml

@@ -112,3 +112,23 @@ pipelines:
               --title "Orca ${VERSION}"
               --note-file CHANGELOG.md
               --asset orca-${VERSION}-linux-amd64.tar.gz
+      - name: container-publish
+        description: Build and publish OCI image to Gitea container registry (REQ-046)
+        image: docker:24-cli
+        env:
+          GITEA_TOKEN: ${GITEA_TOKEN}
+          VERSION: ${CI_COMMIT_TAG}
+          GIT_COMMIT: ${CI_COMMIT_SHA}
+          BUILD_TIME: ${CI_BUILD_TIME}
+        commands:
+          - docker build
+              --build-arg VERSION=${VERSION}
+              --build-arg GIT_COMMIT=${GIT_COMMIT}
+              --build-arg BUILD_TIME=${BUILD_TIME}
+              -t git.cloudinit.dev/coreci/orca:${VERSION}
+              -t git.cloudinit.dev/coreci/orca:latest
+              .
+          - echo "${GITEA_TOKEN}" | docker login git.cloudinit.dev -u cloudinit-bot --password-stdin
+          - docker push git.cloudinit.dev/coreci/orca:${VERSION}
+          - docker push git.cloudinit.dev/coreci/orca:latest
+          - docker logout git.cloudinit.dev