docs: compose files, Dockerfile, CI workflow, README and ci-requirements describe the build, briefly

Comment-only pilot for the comment standard (rule 32, milestone 544).
Issue and rule numbers, dates, run ids and incident stories come out;
the constraint each one guarded stays as a present-tense sentence.

History removed from the files, kept here:
- Dockerfile/CI: installing from uv.lock replaced pip/uv-pip installs that
  ignored the lock (#2194, the mcp 2.0.0 break on 2026-07-28); --locked
  then caught pgvector missing from the lock.
- CI: plugin paths were added after #2198/#2209 reached a live install;
  `integration` joined the build's needs after run 8212 published
  :latest with integration red (#4958); the `[[ ]]` tag step failed
  silently on dash (2a374d9); BUILD_VERSION carried the channel until
  2026-08-31 (#3298).
- jq was removed from the hooks in #4107.
- prod compose: the lenient DB healthcheck followed a runc setns crash
  loop; pgvector arrived with migration 0067 via a PG16->17 dump/restore.

Corrections to match the code: README names the Settings tab
"MCP Access"; ci-requirements says the Dockerfile builds on node:22
and lint covers scripts/.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker-compose.quickstart.yml

@@ -1,16 +1,7 @@
-# Fabled Scribe — Quick Start
-#
-# No build required. Pulls the latest pre-built image from the registry.
-#
-# Usage:
-#   1. Download this file
-#   2. docker compose -f docker-compose.quickstart.yml up -d
-#   3. Open http://localhost:5000 — the first account registered becomes admin
-#   4. Go to Settings → MCP Access and connect Claude (Code or Desktop) via the
-#      bearer-token URL shown there.
-#
-# Set SECRET_KEY via environment variable or a .env file alongside this file:
-#   SECRET_KEY=your-random-secret-here
+# Fabled Scribe from the pre-built image:
+#   docker compose -f docker-compose.quickstart.yml up -d
+# Then open http://localhost:5000 (the first account registered becomes admin)
+# and connect Claude from Settings → MCP Access.
 
 services:
   app:
@@ -19,6 +10,7 @@ services:
       - "5000:5000"
     environment:
       DATABASE_URL: "postgresql+asyncpg://scribe:scribe@db:5432/scribe"
+      # Set SECRET_KEY in the environment or a .env file beside this one.
       SECRET_KEY: "${SECRET_KEY:-change-me-in-production}"
       LOG_LEVEL: "${LOG_LEVEL:-INFO}"
     volumes:
@@ -35,7 +27,7 @@ services:
       start_period: 30s
 
   db:
-    # pgvector image (PG17) — bundles the `vector` extension (migration 0067).
+    # Postgres 17 with the vector extension Scribe needs.
     image: pgvector/pgvector:pg17
     stop_grace_period: 120s
     volumes:
@@ -44,8 +36,8 @@ services:
       POSTGRES_USER: scribe
       POSTGRES_PASSWORD: scribe
       POSTGRES_DB: scribe
-    # Lenient by design: a transient host exec/healthcheck stall must never
-    # escalate to killing the DB. Health here only gates app startup order.
+    # Lenient on purpose: health only orders app startup, so a stalled check
+    # must not get the database killed.
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U scribe"]
       interval: 30s