ci: publish crucible image under deployment/ namespace

registry.westgate.pw/sow/crucible -> /deployment/crucible across build-image
+ release workflows, flake.nix image name, Dockerfile, docs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/consumer-contract.md

@@ -28,7 +28,7 @@ Run the consumer job inside the pinned image and the binaries are on `PATH`:
 
 ```yaml
 container:
-  image: registry.westgate.pw/sow/crucible:<sha>   # pinned, immutable
+  image: registry.westgate.pw/deployment/crucible:<sha>   # pinned, immutable
 ```
 
 No host install, no `$HOME` layout, no developer machine assumptions.