feat(ci): publish steward image to the registry + remote-deploy compose

Add the rule-46 image-publish lane: a `publish` job gated on
[lint, unit, integration] that builds the runtime Dockerfile in ci-builder
and pushes git.fabledsword.com/bvandeusen/steward:<sha> always, :dev on dev
and :latest on main. Authenticates with the REGISTRY_TOKEN repo secret
(the injected GITHUB_TOKEN lacks write:package). Steward is the first family
app to implement the publish lane; mechanics mirror CI-runner's
build-ci-python.yml.

Add compose.deploy.yml for a persistent remote instance that pulls :dev
(no source bind-mounts, persistent app_data+pgdata volumes, bundled Postgres),
plus a README "Remote dev instance" runbook and the POSTGRES_PASSWORD env key.
Fix .env.example's database URL var to the canonical STEWARD_DATABASE_URL
(single underscore) and document the publish lane in ci-requirements.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ci-requirements.md

@@ -14,8 +14,12 @@ git.fabledsword.com/bvandeusen/ci-python:3.14
 
 ## Per-job tool installs
 
-- `uv pip install --system -e '.[dev]'` (pip fallback) — in `unit` and `integration`
-  jobs. Steward declares its deps in `pyproject.toml`; the `[dev]` extra adds
+- `uv pip install --system -e '.[dev]'` (pip fallback) — in the `unit` job.
+- `uv pip install --system -e '.[dev,ansible]'` (pip fallback) — in the
+  `integration` job, which boots the real app and exercises the Ansible runner,
+  so it needs the `ansible` extra (`ansible>=10,<13`) at import time.
+
+  Steward declares its deps in `pyproject.toml`; the `[dev]` extra adds
   `pytest` + `pytest-asyncio`. No `requirements.txt` is tracked.
 
 ## Lanes
@@ -30,6 +34,13 @@ git.fabledsword.com/bvandeusen/ci-python:3.14
   (`create_app(testing=False)`), which runs core + every bundled plugin's
   migrations, then round-trips the DB. This is the guard that the folded-in
   plugin migration graph resolves.
+- **publish** — builds the runtime `Dockerfile` and pushes to the package
+  registry. Runs in `ci-builder:latest` (docker + buildx, socket auto-mounted),
+  gated on `needs: [lint, unit, integration]` so a red commit never ships an
+  image. Publishes `git.fabledsword.com/bvandeusen/steward:<sha>` always, plus
+  `:dev` on `dev` and `:latest` on `main` (FabledRulebook rule 46). Needs the
+  `REGISTRY_TOKEN` repo Actions secret (`read:package` + `write:package`) —
+  the injected `GITHUB_TOKEN` can't push packages.
 
 ## Notes