docs: say the 2.x image is not published; show the local build (audit M6)

README, guide and deploy/docker-compose.yml pinned
ghcr.io/mixeme/selfpost:2.4.1, which does not exist: ghcr.io holds 1.0.0
and 1.3.0 only. The owner decided (2026-10-12) that old tags and images
stay untouched and the pin points forward, made true by the next
publication. Until then:

- README Quick start and guide Fixed image tag say the 2.x line is not on
  ghcr.io and show `docker build ... --build-arg VERSION=2.4.1 -t
  ghcr.io/mixeme/selfpost:2.4.1 .`; with the image present locally,
  docker run and Compose (pull_policy missing) use it without pulling.
- compose header says the same in two lines.
- development.md release steps: bump the version in those notes at each
  cut, remove them at the first publication of the line.
- CHANGELOG [Unreleased], audit plan line ticked, roadmap 4/61.

Documents only; no test reads the pin.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -17,6 +17,12 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   `selfpost-backup -version` against it, and `release.yml` checks the stamp
   again on the image right before pushing it. Images already published are
   left as they are.
+- **The documents no longer promise an image that is not there.** README,
+  the guide and the compose file pinned `ghcr.io/mixeme/selfpost:2.4.1`, but
+  no 2.x image has been published (ghcr.io holds `1.0.0` and `1.3.0`). They
+  now say so and show how to build the image locally under the pinned name,
+  which Compose and `docker run` then use without pulling (audit 2026-10-12,
+  M6). The pin stays: the next publication makes it true.
 - **The e2e module is compiled on every push** (`test.yml`: `go vet` and
   `go test -c` in `test/e2e`), so a type error there no longer first shows
   up in `release.yml` after a release is published (audit 2026-10-12, M20).