Pull the server image on the Pi instead of building it

The Pi now runs registry.mc02.dev/schulcloud-mcp. Its compose file `!reset`s
the build section docker-compose.yml declares, so no `docker compose` command
there can fall back to building (Compose 2.24 or later). SCHULCLOUD_MCP_TAG
pins a commit's image; unset, the Pi follows `latest`.

`npm run publish-image` publishes from a development machine. It builds only a
clean working tree, so a commit tag names exactly that commit's code, for amd64
and arm64, tagged `latest` and with the short commit id. On an x86 machine
arm64 builds under QEMU, which the script checks for and explains rather than
registering unasked.

PI.md logs in to the registry, pulls and starts instead of building, and
updates by publishing and pulling. Rehearsed in a scratch compose project: the
image came from the registry, `up -d --build` built nothing, and the server
came up healthy with its database and no published ports.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

README.md

@@ -162,7 +162,7 @@ src/
   cli/          CLI config, API client, sync engine
   bin/          http, stdio and cli entry points
 docs/           API findings, auth, deployment, CLI, roadmap
-deploy/         Caddyfile snippet
+deploy/         Caddyfile snippet, the Pi's compose file
 scripts/        probe, smoke, session diagnostics
 vendor/         upstream clones, git-ignored, for reference only
 ```
@@ -180,6 +180,7 @@ npm run probe      # check assumptions against the live instance
 npm run smoke      # full end-to-end: real server, real client, real data
 npm run session-diagnose  # instrument what actually ends the session (~2.5h)
 npm run keepalive-status  # is the deployed container holding its session?
+npm run publish-image     # build amd64 + arm64 and push to registry.mc02.dev — the Pi only pulls
 npm run typecheck
 ```