fix(ci): make scaffold e2e hermetic vs the official runtime image + add changeset

The docker e2e builds examples/docker, whose runtime stage is now
FROM ghcr.io/objectstack-ai/objectstack — a tag that doesn't exist until the
first release publishes it. Build that base locally from docker/Dockerfile
inside the job instead of pulling: kills the chicken-and-egg AND makes every
PR exercise the official runtime Dockerfile itself. Also trigger the e2e on
docker/** changes, and add the feature changeset (minor on @objectstack/cli).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0162o68e5w3bpUBEVRQboUGG

Author: claude

.changeset/official-docker-runtime-image.md

@@ -0,0 +1,25 @@
+---
+'@objectstack/cli': minor
+---
+
+feat(docker): official runtime image `ghcr.io/objectstack-ai/objectstack`
+
+ObjectStack now ships an official, versioned Docker runtime image instead of
+only a copy-me example. The image packages Node 22 + a pinned
+`@objectstack/cli` + `os start` (non-root `node` user, `/api/v1/health`
+HEALTHCHECK, `OS_ARTIFACT_PATH` / `OS_PORT=8080` preset), published
+multi-arch (amd64/arm64) on every release with tags mirroring the CLI
+version (`X.Y.Z` / `X.Y` / `X` / `latest`).
+
+Deploying an app is now:
+
+```dockerfile
+FROM ghcr.io/objectstack-ai/objectstack:<version>
+COPY --chown=node:node dist/objectstack.json /srv/app/objectstack.json
+```
+
+or, with no image build at all, `docker run` the official image with the
+artifact mounted (or `OS_ARTIFACT_PATH` pointing at an `https://` URL).
+`examples/docker` and the Self-Hosted Deployment docs now build on the
+official image; the self-built runtime Dockerfile remains documented for
+air-gapped registries.

.github/workflows/scaffold-e2e.yml

@@ -20,6 +20,7 @@ on:
     paths:
       - 'packages/create-objectstack/**'
       - 'examples/docker/**'
+      - 'docker/**'
       - '.github/workflows/scaffold-e2e.yml'
   schedule:
     - cron: '23 3 * * *'
@@ -114,13 +115,24 @@ jobs:
           curl -fsS http://localhost:8080/api/v1/ready
           kill "$SERVER_PID"
 
+      - name: Build official runtime image from this checkout
+        # examples/docker builds FROM ghcr.io/objectstack-ai/objectstack.
+        # Build that base HERE from docker/Dockerfile instead of pulling, so
+        # (a) PRs exercise the official runtime Dockerfile itself, and
+        # (b) the e2e stays hermetic — no dependency on a prior release
+        # having published the tag (chicken-and-egg on the very first one).
+        run: |
+          docker build -t ghcr.io/objectstack-ai/objectstack:latest \
+            --build-arg OS_CLI_VERSION=latest \
+            "$GITHUB_WORKSPACE/docker"
+
       - name: Docker build and run (examples/docker)
         run: |
           cd "$RUNNER_TEMP/e2e-app"
           cp "$GITHUB_WORKSPACE"/examples/docker/Dockerfile \
              "$GITHUB_WORKSPACE"/examples/docker/docker-compose.yml \
              "$GITHUB_WORKSPACE"/examples/docker/.dockerignore .
-          docker build -t e2e-app .
+          docker build --pull=false -t e2e-app .
           docker run -d --name e2e -p 18080:8080 \
             -e OS_SECRET_KEY="$(openssl rand -hex 32)" \
             -e OS_AUTH_SECRET="$(openssl rand -hex 32)" \