feat(miner-deployment): add self-host Dockerfile for fleet-mode gittensory-miner image

[JSONbored]

The Phase 6 fleet-mode deployment guide already exists (packages/gittensory-miner/DEPLOYMENT.md, closed by #2330) but it says so itself: "There is no separate published miner fleet image yet. Run the same CLI inside a standard Node container, mount persistent state, and inject secrets at runtime (never bake them into the image)" (DEPLOYMENT.md:45-47), followed by a manual docker run node:24-slim bash -lc 'npm install -g @jsonbored/gittensory-miner@latest && gittensory-miner doctor && gittensory-miner status' workaround (DEPLOYMENT.md:49-56). This issue builds the real image DEPLOYMENT.md is waiting on.

The repo already has two Dockerfile precedents to mirror rather than invent from scratch:

• Dockerfile (repo root, for gittensory-api) — multi-stage (build → runtime-base → runtime/runtime-prebuilt), non-root node user, ARG GITTENSORY_VERSION threaded to ENV (lines 6, 31-38), a HEALTHCHECK, and — notably — its COPY . .-before-npm ci comment (lines 12-17) already names this exact package by name: "@jsonbored/gittensory-engine (a workspace dependency of gittensory-miner's checked-in lib/*.js artifacts, feat(miner-foundation): extract reward-risk scoring into gittensory-engine #2281) then couldn't be resolved by esbuild no matter how/when its own dist/ was built." packages/gittensory-miner/package.json:37 confirms the same @jsonbored/gittensory-engine workspace dependency still exists today, so this new image needs the same COPY . . ordering the main Dockerfile had to learn the hard way.
• review-enrichment/Dockerfile — a simpler two-stage (build → runtime) example for a package with no bundler step, closer to what the miner needs.

The miner package itself is much lighter than the main service: packages/gittensory-miner/package.json's build script is just node --check over every lib/*.js file (pure ESM, no esbuild/tsc bundling), so this Dockerfile doesn't need the root Dockerfile's multi-stage bundling — npm ci (with the workspace present) plus gittensory-engine's own tsc build is likely enough.

test/unit/miner-deployment-doc.test.ts currently locks in DEPLOYMENT.md's exact wording (toContain("docker run"), toContain("docker-compose.yml"), etc.) — rewriting the Fleet-mode walkthrough to point at the new image must keep that test green, updating it in the same PR if the exact substrings change.

Deliverables

• packages/gittensory-miner/Dockerfile: non-root user, no baked secrets/tokens (credentials injected at docker run time, per DEPLOYMENT.md's existing invariant), and a mounted volume for GITTENSORY_MINER_CONFIG_DIR (the same SQLite-ledgers directory laptop mode already uses — see packages/gittensory-miner/lib/claim-ledger.js:17-31 and sibling stores for the path-resolution chain).
• Handle the workspace-dependency build ordering (COPY . . before npm ci), same fix the root Dockerfile already documents for this exact dependency.
• Update packages/gittensory-miner/DEPLOYMENT.md's "Fleet mode walkthrough" to build/run the new image instead of the ad hoc node:24-slim + npm install -g workaround, keeping test/unit/miner-deployment-doc.test.ts passing (update the test alongside the doc if the exact substrings it asserts on change).
• Decide whether a HEALTHCHECK applies (the miner is a CLI/batch process, not a long-running HTTP service like gittensory-api, so it may not need one unless the image also runs a supervising loop) and note the decision in the Dockerfile's comments either way.

References

• packages/gittensory-miner/DEPLOYMENT.md:45-56 (closed by docs(miner-deployment): write laptop-mode vs fleet-mode deployment guide #2330) — the fleet-mode gap this issue closes, quoted above.
• Dockerfile (repo root) lines 6, 12-17, 31-38 — multi-stage pattern, the workspace COPY . . ordering fix (which already names gittensory-engine/gittensory-miner explicitly), non-root user, ARG/ENV version threading.
• review-enrichment/Dockerfile — simpler two-stage precedent for a package with no bundle step.
• packages/gittensory-miner/package.json:37 (@jsonbored/gittensory-engine workspace dependency) — why the ordering fix applies here too.
• test/unit/miner-deployment-doc.test.ts — the doc assertions this change must keep green.

[linear-code]

JSO-3282