S6 — Ship it: image, compose quickstart, measured README

[fmind]

What a stranger gets: the README, top to bottom, on a clean machine, works — and the time it claims is measured, not estimated.

Acceptance

1. ko image on GHCR: distroless, non-root, no shell, SBOM attached; :main and :sha-* tags published on every push.
2. One-service compose quickstart; mise run test:quickstart runs the shipped compose file byte for byte, cold, and asserts time-to-first-reply.
3. Every number in the README is measured; every pinned tag resolves (check:pins); a4h config check covers both shipped example configs by explicit path.
4. The docs site builds strict; the claims page lists each claim with its verification command, unshipped ones marked not yet.

Non-goals

Helm (demand-gated) · Docker Hub mirror wiring beyond the pull-count counter (TODO item 4).