build(selfhost): prepare official images after stack validation

[JSONbored]

Summary

Prepare the official self-host image/package publishing path after the Git-backed deployment and remaining review-stack validation work are complete.

Context

The stack is close to needing official images, but it should not be published as a supported package until the provider selection, review modes, dashboards, config surface, and operational validation are finished. This issue keeps the image work planned without rushing it.

Requirements

• Treat this as blocked by the Git-backed deployment and validation work.
• Define image names, tags, release triggers, and rollback behavior.
• Decide which build args and optional tools belong in official images.
• Confirm Codex, Claude Code, Ollama, Grafana, and repo-config behavior in a clean stack before publishing.
• Document migration from local build to official image.
• Keep secrets and local runtime data out of images.

Deliverables

• Image/package publishing plan.
• CI/build workflow changes when ready.
• Smoke-test checklist for official images.
• Documentation for self-hosters moving from source checkout to image-based deploy.

Acceptance criteria

• Official image publishing is not enabled until prerequisite validation issues are complete.
• A fresh deployment from the image passes readiness and review-provider smoke tests.
• Release notes and docs clearly describe what is supported and what remains experimental.