Retire the Crucible container image

Nothing consumes registry.westgate.pw/deployment/crucible: prod.yml no
longer reserves a slot for it and no runtime or recovery path pulls it.
Binaries, wrappers, and the Nix input are the supported ways to run
Crucible. Delete the image workflows (build/publish/test), the
Dockerfile, and the make image target; update docs to match.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

README.md

@@ -71,10 +71,9 @@ nix develop            # Go + shellcheck + yamllint + make
 make check             # go vet + go test + shellcheck + yamllint
 make build             # build every cmd/* into ./bin (gitignored)
 make smoke             # build + assert the fail-closed contract
-make image             # docker build -> crucible:<sha>
 ```
 
-Binaries are **never committed** — they are CI artifacts / image layers (D19).
+Binaries are **never committed** — they are CI artifacts (D19).
 This retires the old habit of checking in `nwn-tool` / `sow-toolkit`.
 
 ## CI
@@ -84,12 +83,8 @@ publish event is a `v*` tag (see `runbooks/ci-trigger-standard.md` in sow-docs,
 https://git.westgate.pw/ShadowsOverWestgate/sow-docs).
 
 - `test.yml` — vet, test, shellcheck, yamllint, binary smoke (PR + main).
-- `test-image.yml` — build the OCI image to prove it compiles (PR + main, no push).
 - `build-binaries.yml` — cross-build all targets (PR + main); on a `v*` tag, upload
   the binaries, `SHA256SUMS`, and the wrappers to the Gitea release.
-- `build-image.yml` — on a `v*` tag, build and publish
-  `registry.westgate.pw/deployment/crucible:<sha>`.
-- `publish-image.yml` — manual `workflow_dispatch` break-glass republish.
 - `sync-wrappers.yml` — on a `main` push that touches `wrappers/`, auto-PR the
   canonical wrappers to the consumer repos in `wrappers/consumers.txt`.
   Consumer drift checks run after those PRs merge to `main`, not on the PRs