Repository instructions

Keep Chromium headed by default. Do not add --headless to docker-entrypoint.sh.
Keep upstream downloads restricted to adryfish/fingerprint-chromium Linux x86_64 release assets.
Keep registry credentials in workflow secrets; never commit credentials.
Before submitting changes, run ./tests/check.sh, build the image, and smoke-test Chromium.