Publish Philter Scope Docker image to Docker Hub and show docker-compose on /philter-scope/

[jzonthemtn]

Summary

Two-part task:

1. Create a `philterd/philterscope` Docker Hub repository and publish the Philter Scope image to it.
2. Update the Philter Scope product page (`content/philter-scope.md`) to show a `docker-compose` snippet that pulls and runs the published image.

Why

The Philter Scope page currently shows a CLI-style `philter-scope evaluate` example but no "get it running locally" path for the dashboard (the screenshot on the page advertises a dashboard that the reader has no way to actually start). A published image plus a copy-pasteable compose block closes that gap.

Scope — Docker Hub side (upstream)

The build/publish work lives in philterd/philterscope, not in this repo. This issue tracks the website-visible deliverable; please mirror or link a tracking issue there for:

• `philterd/philterscope` repository created on Docker Hub
• Image tagged with both `:latest` and a semver tag matching the release (mirror the pattern used by `philterd/arbiter`)
• Multi-arch (`linux/amd64`, `linux/arm64`) if feasible
• Release workflow updated to push on tag
• Decide and document how the image consumes policy + gold-standard inputs (bind mount, env-pointed paths, or both) — the website snippet depends on this contract

Scope — website side (this repo)

• Add a `docker-compose` example to `content/philter-scope.md` that pulls `philterd/philterscope`, mounts a local `./policies` and `./gold` directory, and exposes the dashboard port.
• Include a short "run an evaluation" example that lines up with the existing `apiExample` (`--policy healthcare.json --gold test-set.jsonl`) so the CLI and compose stories are consistent.
• Cross-link the Docker Hub page from the product page (alongside the existing GitHub / docs / releases links).
• Reference: `content/arbiter.md` uses `docker pull philterd/arbiter:latest` in its `apiExample` — match the convention. Note that Philter Scope is currently `productKind: "library"`; revisit whether that's still right once there's a runnable image with a dashboard.

Acceptance

• Docker Hub repo exists at `hub.docker.com/r/philterd/philterscope` and `docker pull philterd/philterscope:latest` succeeds.
• Pasting the docker-compose block from `/philter-scope/` into an empty directory with a sample policy + gold file and running `docker compose up` brings up the dashboard reachable in a browser.
• The dashboard screenshot on the page still matches what a reader sees after following the snippet.

Acceptance Criteria

• Philter Scope Docker image published to Docker Hub under philterd/philter-scope
• Image tagged with version and latest
• docker-compose example added to /philter-scope/ product page
• CI/CD workflow publishes new images on release
• Documentation links to Docker Hub and includes pull command

[jzonthemtn]

Prerequisite: PhilterScope has no Dockerfile at all, so there is currently nothing to publish. Filed as #6.

Two things worth settling here, both found while adding PhilterScope to the Philterd Appliance:

• Image name. This issue says philterd/philterscope in the summary but philterd/philter-scope in the last acceptance list. Neither exists on Docker Hub yet, so the name is still free to choose. The appliance's bill of materials currently expects philterd/philterscope.
• The input contract this issue asks to decide is partly answered by how the appliance wires it: philterscope-serve reads audits from MongoDB via PHILTERSCOPE_MONGODB_CONNECTION_STRING and needs no bind mount, while philterscope-audit needs a bind-mounted directory containing golden/ and raw/ and writes its report back there.

Tracked alongside the other appliance gaps in philterd/philterd-appliance#2.