ci: publish crucible image under deployment/ namespace

registry.westgate.pw/sow/crucible -> /deployment/crucible across build-image
+ release workflows, flake.nix image name, Dockerfile, docs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/build-image.yml

@@ -1,5 +1,5 @@
 # Build the Crucible image. PR-first (D7): PRs build only; push to main also
-# publishes registry.westgate.pw/sow/crucible:<git-sha>. Never a mutable tag.
+# publishes registry.westgate.pw/deployment/crucible:<git-sha>. Never a mutable tag.
 #
 # Daemonless: the host-mode runner has no container runtime, so the image is
 # built by Nix (`nix build .#image`, see flake.nix) and pushed with skopeo
@@ -13,7 +13,7 @@ on:
 
 env:
   REGISTRY: registry.westgate.pw
-  IMAGE: sow/crucible
+  IMAGE: deployment/crucible
 
 jobs:
   build-image: