Slim the image, publish on version tags, drop deployment specifics

The first publish failed partway through the push with 413 Payload Too Large:
one layer was bigger than the proxy in front of the registry would accept.

Three changes, only one of which is that fix.

Keep deployment out of a public repo. The registry, image name and credentials
now come from repository variables and secrets rather than being written down
here, and the docs describe how to run the thing rather than where one
particular instance runs. PUBLIC_ORIGIN defaults to localhost. The 413 is a
proxy limit, so the fix is pointing REGISTRY at a host the runner reaches
directly; the workflow explains itself if that host is plain HTTP and the
builder's daemon has not been told to allow it.

Publish on version tags. A tag like 1.2.3 publishes :1.2.3, :1.2, :1 and
:latest; a prerelease publishes only its exact version and leaves :latest
alone. Pushes to main publish :main and :sha-<short> and no longer move
:latest, so what is deployed moves when a release says so.

Shrink the image from over 1.2GB to 353MB. The Playwright base image carries
Firefox and WebKit, which this never launches. Installing just the browser it
does launch onto a slim Node base drops two thirds of the weight, which is
worth having on a Raspberry Pi even though it does not get any single layer
under a proxy limit.

That last change surfaced something worth naming: a headless launch resolves to
Playwright's headless shell, not the full browser, so that is what every test
so far has actually been running. The image now installs exactly that binary
and pool.ts names the channel, so the two cannot drift apart.

Verified in the container: Bluesky, Instagram, X and Threads all resolve
identically on the slim image.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01BGkRmLfiWuJHx6tQ12EELY

README.md

@@ -8,12 +8,10 @@ tracking. antisocial is the other half of a StopTheMadness rewrite rule: the lin
 redirected here, and you get the post — the media and the words — plus a badge saying
 where it came from and a button to copy the original URL if you do want to go there.
 
-Single user, no authentication, tailnet only. It resolves posts by driving a real
-headless browser from a residential IP, logged out, exactly as if you'd opened the link
-yourself.
-
-Served at <https://antisocial.unsupervised.studio> from Kallone. Deployment manifests
-live in the `infra` repo under `k8s/kallone/antisocial.unsupervised.studio/`.
+Built for one person, on a private network. There is **no authentication of any kind** —
+anything that can reach it can drive a browser through it, so put it somewhere only you
+can reach. It resolves posts by driving a real headless browser, logged out, exactly as
+if you had opened the link yourself.
 
 ## StopTheMadness rules
 
@@ -21,16 +19,18 @@ One redirect rule per platform. The host is swapped for antisocial plus a short
 segment; the rest of the path is left alone, so the original is always recoverable and
 readable in your history.
 
+Replace `antisocial.example.com` with wherever you are running it.
+
 | Platform | Find | Replace |
 | --- | --- | --- |
-| X | `^https://(?:www\.\|mobile\.)?(?:x\|twitter)\.com/(.*)$` | `https://antisocial.unsupervised.studio/x/$1` |
-| Threads | `^https://(?:www\.)?threads\.(?:net\|com)/(.*)$` | `https://antisocial.unsupervised.studio/threads/$1` |
-| Instagram | `^https://(?:www\.)?instagram\.com/(.*)$` | `https://antisocial.unsupervised.studio/ig/$1` |
-| TikTok | `^https://(?:www\.\|vm\.\|vt\.)?tiktok\.com/(.*)$` | `https://antisocial.unsupervised.studio/tiktok/$1` |
-| Bluesky | `^https://bsky\.app/(.*)$` | `https://antisocial.unsupervised.studio/bsky/$1` |
+| X | `^https://(?:www\.\|mobile\.)?(?:x\|twitter)\.com/(.*)$` | `https://antisocial.example.com/x/$1` |
+| Threads | `^https://(?:www\.)?threads\.(?:net\|com)/(.*)$` | `https://antisocial.example.com/threads/$1` |
+| Instagram | `^https://(?:www\.)?instagram\.com/(.*)$` | `https://antisocial.example.com/ig/$1` |
+| TikTok | `^https://(?:www\.\|vm\.\|vt\.)?tiktok\.com/(.*)$` | `https://antisocial.example.com/tiktok/$1` |
+| Bluesky | `^https://bsky\.app/(.*)$` | `https://antisocial.example.com/bsky/$1` |
 
 So `https://x.com/user/status/123` becomes
-`https://antisocial.unsupervised.studio/x/user/status/123`.
+`https://antisocial.example.com/x/user/status/123`.
 
 Tracking parameters (`igsh`, `utm_*`, `s`, `t`, and friends) are stripped on arrival, so
 the URL the copy button gives back is the clean one. TikTok `vm.`/`vt.` share codes lose
@@ -132,8 +132,8 @@ link preview offers.
 
 ## Development
 
-Needs Node 22+. Local container builds use Apple `container`, which is arm64 native and
-therefore the same architecture as Kallone.
+Needs Node 22+. The container commands below use Apple `container`; `docker` takes the
+same arguments if that is what you have.
 
 ```sh
 npm ci
@@ -165,7 +165,7 @@ Everything has a working default; the container needs none of it set.
 | `RESOLVE_TIMEOUT_MS` | `30000` | whole resolve, including extraction |
 | `CACHE_TTL_MS` / `CACHE_MAX` | `3600000` / `200` | resolved posts, in memory |
 | `MEDIA_TOKEN_TTL_MS` | `21600000` | how long a `/m/` reference stays valid |
-| `PUBLIC_ORIGIN` | `https://antisocial.unsupervised.studio` | only used to print the rules on `/` |
+| `PUBLIC_ORIGIN` | `http://localhost:8080` | only used to print the rules on `/` |
 | `LOG_LEVEL` | `info` | |
 
 ## Adding a platform