[Bpoe]

Version tags now publish a multi-platform image to ghcr.io/bpoe/indirection and attach a runtime-neutral ZIP to the GitHub Release. The separate Docker job depends on the existing test job, downloads its workflow artifact, and packages the already-published binaries without recompiling. GitHub Release creation requires successful Docker publishing.

The single-stage distroless .NET 10 image runs as the built-in non-root user on port 8080. Docker-specific appsettings defaults SQLite to /data/urls.db, while mounted appsettings can override the complete configuration through normal ASP.NET Core precedence. Compose provides a named data volume and runtime API-key passthrough. Migrations remain explicit through --migrate. README covers image tags, configuration, persistence, migrations, upgrades, and cross-platform ZIP deployment.

Existing CI restore, build, tests, NuGet caching, coverage enforcement/artifacts, and portable publish steps are unchanged. Only the Docker publishing job receives packages: write.

Validation:

• Solution Release build and all 38 tests passed; line coverage 98.97%, branch coverage 100%.
• Single-stage Docker images built for linux/amd64 and linux/arm64.
• Live amd64 container checks passed: /health, UID 1654, no shell/package manager, explicit/idempotent migrations, no automatic startup migrations, persistent SQLite data across container replacement, WAL/SHM files, and mounted configuration writing to /custom/overridden.db.
• ZIP integrity and byte-for-byte inclusion of all 46 published files verified, including original portable defaults and native SQLite dependencies for Linux, Windows, and macOS x64/Arm64.
• Compose configuration, workflow dependencies/permission scope, and git diff --check passed.

Arm64 runtime execution and GHCR publishing were not exercised locally. No release tag was created.