[Chore] Consolidate published images back to roomote-app and roomote-worker

[mrubens]

Summary

• Publish two images again (roomote-app, roomote-worker) instead of eight; the six per-service runtime targets from Harden application container privileges and secret scope #105 are removed and every control-plane service runs from the shared runtime-app target
• The container command and a ROOMOTE_SERVICE env var (now set per service in Compose) select the service and its environment contract, so the per-service env contracts from Harden application container privileges and secret scope #105 keep working unchanged
• Restore the Docker CLI to runtime-app for the controller role; socket access is still restricted to the controller service via the proxy-only docker-api internal network
• Keep all Compose-level hardening from Harden application container privileges and secret scope #105 (read-only filesystems, dropped capabilities, no-new-privileges, tmpfs scratch, socket proxy) and extend the security contract script to assert the ROOMOTE_SERVICE wiring
• Keep the deployment validation from [Chore] Validate deployment artifacts in CI #106, adapted to the two-image world
• Authenticate to GHCR in the deployment-acceptance job. This is the root cause of every failed publish since [Chore] Validate deployment artifacts in CI #106: the six new per-service packages defaulted to private on first publish, and the smoke test pulled its upgrade baseline anonymously (unauthorized on roomote-web:develop). roomote-app and roomote-worker are public, so baseline pulls work either way now, but the job authenticates regardless so a visibility change can never silently block releases again.

Why

The eight-image split had no consumers in the real deployment path — Roomote-Ops templates, the Railway deploy, and the provisioning scripts all still reference roomote-app only — while costing 12 extra build jobs per publish, 6 extra manifests, and the release-gate breakage above. Publishes to GHCR have been blocked since #106 merged; this restores them.

Validation

• deploy/scripts/validate-compose-security.sh
• pnpm deployment:validate (all six compose shapes)
• docker buildx build --check and a full local build of runtime-app; verified docker, gh, opencode, worker release assets, and the migrate bundle are present and the image runs as roomote-app (uid 10000)
• pnpm lint:fast
• Full pnpm deployment:smoke with BASELINE_VERSION=develop (upgrade/rollback against the currently published image) is running locally; result will be posted as a comment

Follow-up

After this merges and publishes, the six orphaned private GHCR packages (roomote-web, roomote-api, roomote-controller, roomote-bullmq, roomote-preview-proxy, roomote-migrate) can be deleted.