Packaging and deployment — image, compose, upgrade path #20

A customer must be able to install and run it without us. Post-v1 — v1 is M1+M2.

Scope

• Dockerfile building the metadata artifact onto ghcr.io/objectstack-ai/objectstack, plus docker-compose.yml with Postgres and the required secrets (OS_AUTH_SECRET, OS_SECRET_KEY, POSTGRES_PASSWORD).
• docs/deployment/self-hosting.md: bare Node, containers, reverse proxy, backup, health check.
• docs/deployment/upgrading.md: how a customer takes a new version without losing configuration, and what a schema change means for their data.
• A release workflow that tags, builds and publishes.

Must be documented explicitly

The enterprise-edition requirement. Manager visibility is built on the ADR-0057 depth scopes, which @objectstack/security-enterprise resolves. On the open edition they fall back to owner-only — silently, no error, no log line — so a manager dashboard renders plausibly with the wrong rows in it.

This has to be a prominent line in the deployment doc and a checklist item in the install steps, not a footnote. It is the failure mode most likely to be discovered by a customer rather than by us, and it looks like working software right up until someone notices the numbers are too small.

Also

• Timezone configuration: how an operator sets the org default that new duties inherit.
• The dispatcher's cron and what happens if the runtime is down across a period boundary (the answer is backfill — Dispatcher job — idempotent task generation, backfill-capable #2 — and the doc should say so).