build(selfhost): finalize first official image release

[JSONbored]

Parent: #1819

Context

The repository has a self-host release workflow that can build multi-arch GHCR images with provenance, SBOM, Sentry source maps, and GitHub Releases from selfhost-v* tags. Before cutting the first official self-host release, the release path needs an explicit checklist and clean install validation.

This issue is release-readiness work, not a request to publish immediately.

Requirements

• Define the first supported image name, tags, versioning scheme, and release trigger.
• Confirm official images include only runtime code and intended bundled tools, not source maps, local auth, private config, secrets, data volumes, .env, or deployment overrides.
• Confirm Sentry behavior: release artifacts/source maps are uploaded for official images, but runtime reporting is disabled unless the operator sets their own SENTRY_DSN.
• Validate clean install, upgrade from source-built deploy, rollback to prior tag, and one-service app restart behavior.
• Decide whether to publish one default image or separate full and minimal variants for bundled AI CLIs.
• Ensure release notes clearly state what is supported, experimental, optional, and operator-owned.

Deliverables

• First-release checklist for selfhost-v0.1.0 or the chosen initial version.
• Smoke-test matrix for fresh install, upgrade, rollback, Sentry release validation, and docs links.
• Image-size and contents audit, including .dockerignore verification.
• Operator upgrade path from Git checkout builds to released image tags.
• GitHub Release notes template for the first self-host release.

Acceptance criteria

• A clean operator can pull a pinned GHCR image and boot the stack without building from source.
• The image contents audit proves no private configs, credentials, data, or source maps are shipped.
• Release source maps align with the baked GITTENSORY_VERSION / Sentry release id.
• Rollback instructions are clear and tested against migration constraints.
• The release can be cut repeatably from a commit reachable from main.

Validation

• Run release workflow dry-run or equivalent local release checks where practical.
• Build the runtime image and verify /ready in a clean compose environment.
• Validate image metadata, SBOM/provenance settings, and Sentry release checks.

Ownership

Maintainer-only. No gittensor:* labels.

[JSONbored]

Closing as shipped. Every deliverable is implemented and has been exercised in production, not just planned: the release pipeline (.github/workflows/release-selfhost.yml) is live, docs.self-hosting-release-checklist.tsx has the full versioning/smoke-matrix/image-contents-audit/release-notes-template checklist (942MB→754MB image-size trim documented), scripts/smoke-selfhost.sh + scripts/deploy-selfhost-image.sh/deploy-selfhost-prebuilt.sh cover boot/health/upgrade/rollback, and .dockerignore/Dockerfile confirm no secrets/source-maps/local-auth/private-config/data-volumes ship in the image. orb-v0.1.0 (first non-prerelease GitHub Release, 2026-07-04) through orb-v0.4.0-beta.4 (deployed today) are real, published releases. The only loose end is a cosmetic doc-tense nit (checklist text still reads as if orb-v0.1.0 is upcoming) — not a functional gap, not worth reopening for.