Publish verified Docker images to GHCR

Make deployments pull immutable CI-built images while keeping test failures diagnosable before any package is published.

README.md

@@ -204,13 +204,21 @@ Deployment:
 # Create this only when the existing MySQL is containerized and the network is absent.
 docker network create --internal account-backend
 
+# Authenticate once because the GHCR package is private.
+echo "$GHCR_TOKEN" | docker login ghcr.io -u hkgood --password-stdin
+
 # Put deployment values in an uncommitted .env or 1Panel secret/environment store.
-docker compose config
-docker compose up -d --build
+docker compose config --quiet
+docker compose pull
+docker compose up -d
 docker compose ps
 curl --fail http://127.0.0.1:18080/health/ready
 ```
 
+Every successful `main` CI run publishes `ghcr.io/hkgood/osg-account-server:main` plus an immutable
+`sha-<commit>` tag. Production should pin a tested immutable tag in `IMAGE_TAG`; use `main` only for
+initial staging. `GHCR_TOKEN` needs package-read permission and must not be stored in `.env`.
+
 If MySQL runs directly on the host or another private server, keep the external network declaration
 but set `DATABASE_URL` to a private hostname reachable from that network. The application also joins
 the separate egress network for Apple and provider HTTPS calls. Never publish MySQL port 3306 to the