release: 2.4.2: audit stage 0, release hygiene

Stage 0 of docs/audit-2026-10-12.md, 7/7: the release image says which
release it is (H1), the e2e module is compiled on every push (M20),
test/ is out of the build context (L33), the documents say the 2.x image
is not published and show the local build (M6), dependencies raised,
staticcheck clean, the negative e2e cases held to their own refusals
(which showed the level-1 rate-limit case had never seen the limit).

CHANGELOG cut; pin 2.4.2 in deploy/docker-compose.yml, README (with the
local-build note), guide; development.md "from pin" and the planned cuts
of the audit's stages (2.5.0 ... 2.6.0); roadmap row in progress and the
recommended order; stage 0 marked shipped in the plan. No tag (the
owner's command only).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/audit-2026-10-12.md

@@ -543,7 +543,7 @@ card, and it is not planned) are mockup-first; a migration the test server
 has already run is never edited — the next file is added; the published
 `1.x` tags and images are history and are not touched.
 
-### Stage 0 — release hygiene (no product code) → `2.4.2`
+### Stage 0 — release hygiene (no product code) → `2.4.2` (shipped 2026-10-14)
 
 - [x] **Stamp the right version** (H1). Make the e2e build take the version from
    the environment (`VERSION: ${SELFPOST_E2E_VERSION:-e2e}` in