HH-500: add reproducible production dist bundle (#111)

* HH-500: add reproducible production dist bundle

* HH-500: make production bundle builds reproducible

* HH-500: lock complete runtime APK closure

---------

Co-authored-by: Rogee <rogee@ipao.vip>

deploy/docker/README.dist.md

@@ -0,0 +1,27 @@
+# GoChat production bundle
+
+This directory is a source-free delivery package. It contains the GoChat and
+Shangwutong images plus every repository file referenced by the production
+Compose configuration.
+
+```bash
+sha256sum -c SHA256SUMS
+docker load --input images/gochat-*-images.tgz
+cp .env.example .env
+# Replace every CHANGE_ME value and create the external secret/mount paths.
+docker compose --env-file .env -f deploy/docker/docker-compose.prod.yml config --quiet
+docker compose --env-file .env -f deploy/docker/docker-compose.prod.yml --profile ops run --rm migrate
+docker compose --env-file .env -f deploy/docker/docker-compose.prod.yml up -d --wait
+```
+
+The bundle uses source-versioned local image tags so it can start immediately
+after `docker load`; `SHA256SUMS` protects the handoff. Before registry-based
+production promotion, push both images, replace the two image references in
+`.env` with immutable `@sha256:` references, then run:
+
+```bash
+deploy/docker/preflight.sh .env
+```
+
+See `docs/ops/02-production-operations.md` for TLS, backup, rollback, and drill
+requirements.