[stevenAthompson]

The published autumn27/artex image no longer exists (Docker Hub returns 404), while docker-compose.yml still pulled it from a namespace that could be reclaimed. This builds the image from source instead.

Changes:

• multi-stage Dockerfile: frontend static export, Go binary with the embedded UI, pinned tools, runtime layer
• tool downloads verified against the checksums published in each release: nuclei, httpx, subfinder, katana, ffuf, dalfox
• sqlmap pinned to tag 1.9.9 and commit cceda39208b5aad478de2c3f731df4239d9881f6
• Node 22.23.4 from the official tarball with SHASUMS256 verification; Playwright MCP/CLI/playwright pinned
• docker-compose.yml builds artex:local; install.sh and update.sh build instead of pull
• release workflow publishes to GHCR instead of Docker Hub
• README and .env.example updated; the stale one-click-update note is removed from build.sh

Verification on the build machine (no Docker daemon available there), rebased on v0.4.0:

• go build ./..., go vet ./...: pass
• npm run build:static with Node 22: pass
• GOOS=linux GOARCH=amd64 go build -tags embedui -trimpath -ldflags ... ./cmd/artex: pass; the resulting binary starts and prints usage
• every tool archive downloaded and matched its published checksum; the sqlmap commit matched
• hadolint Dockerfile: no errors (DL3008 and DL4006 warnings only)
• compose and release workflow YAML parse; shell scripts pass bash -n

docker build itself was not executed because the machine has no container runtime. Keeping this as a draft until docker compose build has been run once on a Docker host or in CI.