Pull the server image on the Pi instead of building it

The Pi now runs registry.mc02.dev/schulcloud-mcp. Its compose file `!reset`s
the build section docker-compose.yml declares, so no `docker compose` command
there can fall back to building (Compose 2.24 or later). SCHULCLOUD_MCP_TAG
pins a commit's image; unset, the Pi follows `latest`.

`npm run publish-image` publishes from a development machine. It builds only a
clean working tree, so a commit tag names exactly that commit's code, for amd64
and arm64, tagged `latest` and with the short commit id. On an x86 machine
arm64 builds under QEMU, which the script checks for and explains rather than
registering unasked.

PI.md logs in to the registry, pulls and starts instead of building, and
updates by publishing and pulling. Rehearsed in a scratch compose project: the
image came from the registry, `up -d --build` built nothing, and the server
came up healthy with its database and no published ports.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

deploy/docker-compose.pi.yml

@@ -10,6 +10,12 @@
 
 services:
   schulcloud-mcp:
+    # The Pi runs the image published to the registry and never builds one:
+    # scripts/publish-image.sh builds it for arm64 and amd64 elsewhere. `!reset`
+    # drops the build section docker-compose.yml declares, so no `docker compose`
+    # command here can fall back to building (Compose 2.24 or later).
+    image: registry.mc02.dev/schulcloud-mcp:${SCHULCLOUD_MCP_TAG:-latest}
+    build: !reset null
     environment:
       # The bundled Postgres, by name on the private backend network. Overrides
       # any DATABASE_URL in .env.