ci: publish crucible image under deployment/ namespace

registry.westgate.pw/sow/crucible -> /deployment/crucible across build-image
+ release workflows, flake.nix image name, Dockerfile, docs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -61,7 +61,7 @@ This retires the old habit of checking in `nwn-tool` / `sow-toolkit`.
 PR-first (D7): every check runs on pull requests and on push to `main`.
 
 - `test.yml` — vet, test, shellcheck, yamllint, binary smoke.
-- `build-image.yml` — build `registry.westgate.pw/sow/crucible:<sha>`; publish
+- `build-image.yml` — build `registry.westgate.pw/deployment/crucible:<sha>`; publish
   only on `main`. PRs build but never push. No mutable tags.
 - `release.yml` — tag-gated binary bundles; image re-tag is wired in Phase 6.