Add a Dockerfile, compose file and guide to run FlyBot in a container - #482

Fixes #352

What. First slice per the Owner decision (option a): a Dockerfile, compose.yaml and a short guide (docs/docker.md, docs/docker.zh.md) to run one FlyBot per person on a Linux box. You build the image yourself; nothing is published or deployed.

• Image: packs core + plugins/{social,tree,timeline} with check-pack.mjs (the release tarballs), runtime node:24-bookworm-slim + DSH 0.2.0-rc.2 (pinned like the README) + pnpm + tini. User node (uid 1000), one volume /data, health check, no keys or tokens in the image (.dockerignore drops .env, .credentials.yaml, .dsh*).
• Each start links the image's packages into /data/profiles/web (your cordis.patch.yml and own plugins are kept), then runs dsh web. Sign-in stays DSH's own ?token= link (in docker compose logs).
• compose.yaml publishes the port on the host's 127.0.0.1 only; DEEPSEEK_API_KEY is passed through only when set. Remote access: your own HTTPS proxy or SSH tunnel.
• Inside the container DSH listens on 0.0.0.0 through a profile overlay (docker/web.patch.yml; the webserver config allows it, the CLI flag refuses it). That reaches only the container's network; the DSH Host/Origin fence and token still apply.
• CI: new Docker workflow (only when these files change) builds the image, compose up --wait on the health check, checks 401 on the loopback port, the printed sign-in line (never shown), non-root uid and the linked packages. No push, no registry login.
• release.yml is untouched.

Test. ARCH_DOCS_BASE=origin/main TZ=UTC npm run verify passes (0 failures), including the new .github/scripts/docker-profile.test.mjs. Locally without Docker: ran docker/entrypoint.mjs against the packed packages and the harness DSH: started, health check OK, 401 unauthenticated, token link → 303 → 200, foreign Host → 403, SIGTERM stops it. actionlint clean. Docker is not installed on the dev box, so the image build itself is checked by the Docker workflow on this PR.

Risk tier: T3 (estimate; the controller sets the label) — adds a workflow under .github/.