Docker image + Proxmox LXC install rail

[theogravity]

What

GHCR release image + Proxmox LXC rail, and the update rail that points containerized installs at them.

• Dockerfile: packages the signed cli-server release binary on debian:trixie-slim with tmux, Node 22, and the five harness CLIs; first-boot entrypoint runs init detached (setsid) and mints a unique BETTER_AUTH_SECRET on the /data volume. docker-compose.yaml repoints at the GHCR image; the secret is no longer required env.
• docker-image.yml: on cli-server-v* releases (or dispatch), downloads both linux assets, verifies the minisign manifest signature and digests (scripts/docker-release-verify.ts, refused by name), builds amd64+arm64 on native runners, pushes :<version>, runs the container scenario (scripts/cli-e2e/docker-image.sh), and only then moves :latest (release events only).
• proxmox-server.sh: host helper (community-scripts convention) - unprivileged Debian 13 LXC with Docker inside, install/update/backup/restore, update = pull + recreate with rollback on a failed health gate; served at subshell.sh/proxmox-server.sh; shellcheck gates it in lint.yml.
• proxmox-node.sh: the NODE half of the rail - a plain unprivileged LXC (no Docker) that runs the instance's OWN setup-keyed install command inside (pasted once, validated before anything is created, loopback refused in either clause, key never echoed or persisted). Node installs stay per-instance by design; nothing key-less is published.
• Server: containerized deployment fact (SUBSHELL_CONTAINER=1), UPDATE_CONTAINERIZED refusal, the same remedy on the restart refusal and canApply.reasons, and update --check honesty (json flag + prose). Docs: docker rewrite, new proxmox page (+ "As a node" section), updating pointer, one add-a-machine note.

Spec docs/superpowers/specs/2026-09-28-docker-proxmox-lxc-design.md, plan docs/superpowers/plans/2026-09-28-docker-proxmox-lxc.md (two operator-ruled plan amendments: NodeSource Node 22 + the failed-pull must not strand the running container).

Verification

Full verify-types/lint:check/lint:prose/test/turbo build green; server-update.sh scenario clean; the docker scenario green against a branch-built image (version, five harnesses on PATH, containerized --check, secret byte-stable across a recreate). Review ran to zero findings across five rounds (two whole-branch, one whole-rail + closures); the validator matrix (app-rendered forms, carry clause, loopback refusals, junk) is pinned in review evidence.

What CI cannot prove here (the merge gates)

1. docker-image.yml first runs on the next cli-server release. A dispatch on the current newest (1.5.0) is a sanctioned PARTIAL check: the published binary predates this PR's --check code, so the scenario's section 4 only goes green on a post-merge cut. The first docker push may land the GHCR package private; the workflow warns - flip visibility once at org settings if it fires.
2. Proxmox acceptance is a manual pass on a real host: proxmox-server.sh install, first-run registration, open a pane, proxmox-server.sh update, expect the pane to end and data to survive.