[Mimic890]

Makes docker-compose.yml safe to use as is in production.

• docker-compose.yml: no build: .. It only pulls ghcr.io/mimic890/hyperhack:0.1.0. The release workflow tags images with type=semver,pattern={{version}}, so git tag v0.1.0 becomes image tag 0.1.0.
• compose.dev.yml: local build from the checkout (extends the production service, adds build: ., image hyperhack:dev). Run with docker compose -f compose.dev.yml up --build. No docker-compose.override.yml, because Compose would load it in production too.
• README (EN + RU): Quick start downloads docker-compose.yml and .env.example, creates and chowns ./data and ./vault to 10001:10001, fills .env, then docker compose up -d. The step that edited image: and removed build: is gone. Upgrading: back up, change the tag, verify, pull, up; rollback steps.
• SPEC (EN + RU): Deployment and Supply chain sections, GHCR moved from Proposed to decided, Decision log entry.

Checked:

• docker compose config for both files.
• docker compose pull of 0.1.0.
• docker compose -f compose.dev.yml build.
• Production file started the image under the compose settings and reached listening.
• gh attestation verify for 0.1.0.
• vet, staticcheck, govulncheck, go test -race.

Release process note: after each release, a PR has to move the tag in docker-compose.yml, because Quick start downloads that file from main.