docs: compose files, Dockerfile, CI workflow, README and ci-requirements describe the build, briefly

Comment-only pilot for the comment standard (rule 32, milestone 544).
Issue and rule numbers, dates, run ids and incident stories come out;
the constraint each one guarded stays as a present-tense sentence.

History removed from the files, kept here:
- Dockerfile/CI: installing from uv.lock replaced pip/uv-pip installs that
  ignored the lock (#2194, the mcp 2.0.0 break on 2026-07-28); --locked
  then caught pgvector missing from the lock.
- CI: plugin paths were added after #2198/#2209 reached a live install;
  `integration` joined the build's needs after run 8212 published
  :latest with integration red (#4958); the `[[ ]]` tag step failed
  silently on dash (2a374d9); BUILD_VERSION carried the channel until
  2026-08-31 (#3298).
- jq was removed from the hooks in #4107.
- prod compose: the lenient DB healthcheck followed a runc setns crash
  loop; pgvector arrived with migration 0067 via a PG16->17 dump/restore.

Corrections to match the code: README names the Settings tab
"MCP Access"; ci-requirements says the Dockerfile builds on node:22
and lint covers scripts/.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ci-requirements.md

@@ -16,11 +16,10 @@ real Postgres), build (docker buildx).
 ## Image deps used
 
 - python 3.14
-- node 24 (used for `npm ci` + `vue-tsc` in the typecheck job, and as the
-  frontend builder stage inside the production `Dockerfile`)
-- ruff (lint job runs `ruff check src/` with zero install overhead)
-- uv (test + integration jobs run `uv sync --locked`; installed in the
-  image since the ci-python Dockerfile started pip-installing it)
+- node 24 (`npm ci` + `vue-tsc` in the typecheck job; the production
+  `Dockerfile` builds the frontend on `node:22-alpine`)
+- ruff (lint job runs `ruff check src/ scripts/` with zero install overhead)
+- uv (test + integration jobs run `uv sync --locked`)
 - docker CLI + buildx (build job pushes the production image to the
   Fabled-Git registry)
 
@@ -30,24 +29,15 @@ Anything CI installs at job time that isn't in the image. Promotion
 candidates if more than one project needs them.
 
 - `shellcheck` — apt-installed in the **plugin** job, which lints the
-  Claude Code hook scripts and runs their fail-open smoke test. Per
-  `docs/process.md`'s decision checkpoint, single-consumer deps stay
-  per-job until a second consumer wants them; Scribe is the only one so
-  far. It is small (~20 MB) and would be a promotion candidate the moment
-  another project lints shell.
+  Claude Code hook scripts and runs their fail-open smoke test. Scribe is
+  its only consumer, so per `docs/process.md` it stays per-job. It is small
+  (~20 MB) and a promotion candidate once another project lints shell.
 
-- `jq` — **no longer installed anywhere, and should not be promoted.**
-  It was installed in two jobs, and this file used to record it as "load-
-  bearing for the smoke test specifically", because every hook opened
-  `command -v jq || exit 0` and the test would otherwise pass while
-  exercising nothing. That was the tail wagging the dog: the hooks ship to
-  users, jq is absent by default on macOS, the Debian/Ubuntu slim images,
-  Alpine and most CI containers, and a machine without it got no context,
-  no rules, no prior art and no process sync in silence. #4107 removed the
-  dependency rather than documenting it, so the smoke test now runs on a
-  bare image — which is the condition it was always meant to assert. The
-  hooks use only POSIX tools (awk, sed, tr, od, cut, head, tail, grep,
-  sort, date, printf) plus `git` and `curl`.
+The hooks ship to users' machines, so they use only POSIX tools (awk, sed,
+tr, od, cut, head, tail, grep, sort, date, printf) plus `git` and `curl`.
+The smoke test runs on a bare image to keep it that way: a tool such as `jq`
+is missing on macOS, slim Debian/Ubuntu and Alpine, and a hook that needed it
+would give those machines nothing.
 
 ## Notes