#14: Gitea CI, registry composes, Node 22 image and changelog

- Gitea Actions: Trivy, Vitest in a Dockerfile test stage, arm64 image build, image
  scan and smoke test; releases reuse the image by content hash.
- docker-compose.<edition>.registry.yaml run the stack from the published image.
- Dockerfile: Node 22, a test stage, and no npm in the runtime image.
- README, CLAUDE.md and CHANGELOG describe the CI, the image and the release flow.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

scripts/plano-imagem.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Uso: scripts/plano-imagem.sh <registro> <repositório>
+# Imprime inputs=, image= e reuse= (para $GITHUB_OUTPUT). O hash cobre só os
+# arquivos que entram no build da imagem, não a documentação nem a configuração
+# de ferramentas. reuse=true quando o registro já tem inputs-<hash>.
+set -euo pipefail
+registry=$1; ns=${2,,}
+
+inputs=$(git ls-tree -r HEAD \
+  | awk -F'\t' '$2 !~ /^(\.gitea|\.github|\.claude|\.superpowers|\.wolf)\// && $2 !~ /^(README.*|CHANGELOG\.md|CLAUDE\.md|LICENSE|\.gitignore|\.gitattributes|\.trivyignore|docker-compose.*\.yaml|\.env\.example|scripts\/release-notes\.sh)$/' \
+  | sha256sum | cut -c1-16)
+token=$(curl -fsS "https://$registry/v2/token?service=container_registry&scope=repository:$ns:pull" | jq -r .token)
+code=$(curl -s -o /dev/null -w '%{http_code}' -I \
+  -H "Authorization: Bearer $token" \
+  -H 'Accept: application/vnd.oci.image.index.v1+json,application/vnd.docker.distribution.manifest.list.v2+json,application/vnd.oci.image.manifest.v1+json' \
+  "https://$registry/v2/$ns/manifests/inputs-$inputs")
+echo "inputs-$inputs -> HTTP $code" >&2
+reuse=false; [ "$code" = 200 ] && reuse=true
+echo "inputs=$inputs"
+echo "image=$registry/$ns"
+echo "reuse=$reuse"