docs: say the 2.x image is not published; show the local build (audit M6)

README, guide and deploy/docker-compose.yml pinned
ghcr.io/mixeme/selfpost:2.4.1, which does not exist: ghcr.io holds 1.0.0
and 1.3.0 only. The owner decided (2026-10-12) that old tags and images
stay untouched and the pin points forward, made true by the next
publication. Until then:

- README Quick start and guide Fixed image tag say the 2.x line is not on
  ghcr.io and show `docker build ... --build-arg VERSION=2.4.1 -t
  ghcr.io/mixeme/selfpost:2.4.1 .`; with the image present locally,
  docker run and Compose (pull_policy missing) use it without pulling.
- compose header says the same in two lines.
- development.md release steps: bump the version in those notes at each
  cut, remove them at the first publication of the line.
- CHANGELOG [Unreleased], audit plan line ticked, roadmap 4/61.

Documents only; no test reads the pin.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/docker-compose.yml

@@ -18,6 +18,8 @@
 # The image tag below is FIXED on purpose: backup restore compares the manifest
 # version against the running binary's version, so ":latest" would make that
 # check meaningless. Bump the tag deliberately when you want to upgrade.
+# The 2.x line is not on ghcr.io yet: build it locally under this exact name
+# (README, Quick start) and Compose will use it without pulling.
 
 services:
   selfpost: