chore: prepare v0.0.1 release

[suraciii]

Summary

• document the source-only v0.0.1 release contract and immutable tag sequence
• add a manually dispatched workflow that validates, tags, and creates the GitHub release
• resume safely from a matching annotated tag or an existing GitHub release
• document exact Go installation and user-built Docker images
• add a non-publishing Docker build to the existing required CI check
• record completion of the Caddy static-host contract

Verification

• make ci
• go test -race -count=1 ./...
• actionlint for both GitHub Actions workflows
• Linux, macOS, and Windows cross-builds on amd64 and arm64
• local Publish to an isolated Public Root
• non-root, read-only Caddy returned the Page with 200
• /.pages/* returned 404 and the reference security headers were present
• Chromium rendered the Page and CSP blocked its inline script

No tag, GitHub release, binary artifact, or container image was published.