docs: say the 2.x image is not published; show the local build (audit M6)

README, guide and deploy/docker-compose.yml pinned
ghcr.io/mixeme/selfpost:2.4.1, which does not exist: ghcr.io holds 1.0.0
and 1.3.0 only. The owner decided (2026-10-12) that old tags and images
stay untouched and the pin points forward, made true by the next
publication. Until then:

- README Quick start and guide Fixed image tag say the 2.x line is not on
  ghcr.io and show `docker build ... --build-arg VERSION=2.4.1 -t
  ghcr.io/mixeme/selfpost:2.4.1 .`; with the image present locally,
  docker run and Compose (pull_policy missing) use it without pulling.
- compose header says the same in two lines.
- development.md release steps: bump the version in those notes at each
  cut, remove them at the first publication of the line.
- CHANGELOG [Unreleased], audit plan line ticked, roadmap 4/61.

Documents only; no test reads the pin.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -106,6 +106,16 @@ One container, panel at `http://127.0.0.1:8080` — no reverse proxy, no TLS
 files, no compose files. Good for clicking through the UI on your machine;
 outbound mail will not reach the real internet without DNS, PTR, and port 25.
 
+> **The 2.x line is not published on ghcr.io yet** (the newest image there is
+> `1.3.0`). Until it is, build the image from this checkout under the name the
+> commands below and `deploy/docker-compose.yml` use; Docker then takes the
+> local image and pulls nothing:
+>
+> ```sh
+> docker build -f build/Dockerfile --build-arg VERSION=2.4.1 \
+>   -t ghcr.io/mixeme/selfpost:2.4.1 .
+> ```
+
 ```sh
 docker run --rm -d --name selfpost-try \
   -p 127.0.0.1:8080:8080 \