feat: registry-push the post office image; version the statusline

## Registry

The image moved by `docker save | ssh | docker load`, so a rebuild meant
repeating that by hand. It is now published and the compose pulls a
digest-pinned reference, so a redeploy is `compose up -d` on any host
that has logged in.

Pinned by digest rather than by tag: `:3.0.0` is a mutable pointer on a
registry anyone can re-push, and this container is the fleet's whole
message bus. The tag rides alongside so a human can read what it is.

Namespace is claude-bot, not vh. claude-bot's token carries
write:package and `docker login` succeeds, but package namespaces are
owned -- pushing to vh/ returns "unauthorized: authentication required"
after a successful login, which reads like a credential fault and is
actually an ownership one. Publishing under claude-bot's own namespace
also satisfies the standing directive to stop reusing the operator's
personal credentials for infra work, so the constraint and the policy
point the same way. Recorded in the compose header so the next person
does not read that error as a broken token.

Pull path proven rather than assumed: the running container was
recreated from the registry reference and its data verified afterwards.

## Statusline

Brought under version control because the v3 cutover broke it invisibly.
The segment gated on `command -v althing-cli`, a binary the cutover
deleted, so the unread badge and the armed bell silently vanished for
every session on the box. With 71 of 73 handles pull-only, that badge is
the only out-of-band signal telling a session with no armed waiter that
it has mail -- a dead statusline made a working bus look like an empty
one.

Canonical here, live at ~/.claude/statusline-command.sh, copies rather
than symlinks per the same rule as stacks/.

stacks/althing-post-office/compose.yaml

@@ -26,14 +26,32 @@
 # sides before deleting anything.
 #
 # Deploy:  scripts/deploy-stack.sh nh3-docker althing-post-office
-# Image:   built from the althing repo's Dockerfile (vh/althing @ v3.0.0) and
-#          transferred with `docker save | ssh | docker load`. There is no
-#          registry push for this image yet — that is a follow-up, and until it
-#          exists a rebuild means repeating the save/load.
+# Image:   built from the althing repo's Dockerfile (vh/althing @ v3.0.0), pushed to
+#          the gitea registry 2026-08-28. Rebuild + republish:
+#
+#            cd ~/development/althing
+#            docker build -t gitea.phasefinal.com/claude-bot/althing-post-office:<ver> .
+#            echo $(cat ~/.config/claude-bot/gitea-token) | \
+#              docker login gitea.phasefinal.com -u claude-bot --password-stdin
+#            docker push gitea.phasefinal.com/claude-bot/althing-post-office:<ver>
+#
+#          then update the digest below and redeploy. Supersedes the
+#          `docker save | ssh | docker load` hand-carry the move originally used.
+#
+# ⚠ NAMESPACE IS `claude-bot`, NOT `vh`. claude-bot's token carries write:package
+#   but package namespaces are owned: pushing to `vh/...` returns
+#   `unauthorized: authentication required` AFTER a successful `docker login`, which
+#   reads like a credential fault and is actually an ownership one. Publishing under
+#   claude-bot's own namespace also satisfies the standing directive to stop reusing
+#   the operator's personal credentials for infra work. Both hosts are logged in as
+#   claude-bot; a new host needs that login before it can pull.
 
 services:
   post-office:
-    image: althing-post-office:local
+    # Digest-pinned, not tag-floating: `:3.0.0` is a mutable pointer on a registry
+    # anyone can re-push, and this container is the fleet's whole message bus. The
+    # tag is kept alongside the digest purely so a human can read what it is.
+    image: gitea.phasefinal.com/claude-bot/althing-post-office:3.0.0@sha256:410fed41fa049c41cf83577fd2e49831ea1959ca50b597a8bd35a548e267cf01
     container_name: althing-post-office
 
     # ─── Host networking, so the bind guard keeps working ────────────