#14: Gitea CI, registry composes, Node 22 image and changelog

- Gitea Actions: Trivy, Vitest in a Dockerfile test stage, arm64 image build, image
  scan and smoke test; releases reuse the image by content hash.
- docker-compose.<edition>.registry.yaml run the stack from the published image.
- Dockerfile: Node 22, a test stage, and no npm in the runtime image.
- README, CLAUDE.md and CHANGELOG describe the CI, the image and the release flow.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

scripts/release-notes.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Imprime as notas de uma release: a imagem publicada (quando houver) e a seção
+# do CHANGELOG.md daquela versão (ou o log de commits desde a tag anterior, se
+# não houver seção).
+#
+#   scripts/release-notes.sh v1.2.3 [git.exemplo.com/dono/projeto]
+set -euo pipefail
+
+tag=${1:?uso: release-notes.sh <tag> [imagem]}
+image=${2:-}
+version=${tag#v}
+
+if [ -n "$image" ]; then
+  echo "## Imagem"
+  echo
+  echo '```'
+  echo "$image:$version"
+  echo '```'
+  echo
+fi
+
+section=""
+if [ -f CHANGELOG.md ]; then
+  section=$(awk -v head="## [$version]" '
+    index($0, head) == 1 { found = 1; next }
+    found && /^## \[/ { exit }
+    found && /^\[[^]]+\]: / { next }
+    found { print }
+  ' CHANGELOG.md)
+fi
+
+if [ -n "$(printf '%s' "$section" | tr -d '[:space:]')" ]; then
+  printf '%s\n' "$section"
+else
+  previous=$(git describe --tags --abbrev=0 "$tag^" 2>/dev/null || true)
+  echo "## Mudanças${previous:+ desde $previous}"
+  echo
+  git log --no-merges --format='- %s (%h)' "${previous:+$previous..}$tag"
+fi