EqualifyEverything / equalify-iris

#467's items 1-5, in one PR: the reference deployment is one a stranger can run. The gap that set the shape of it: `src/index.ts` explained why `/v1/health` sits above the rate limiter — "a container healthcheck runs on the same host" — and that comment was the only healthcheck in the repo. A comment can describe a mechanism that was never built. The reasoning was right, so the mechanism was added and `test/container.test.ts` is new, pinning each mechanism to the reason given for it. What ships: - a HEALTHCHECK in the Dockerfile and a healthcheck: in compose, both polling /v1/health, on the port config.example.yaml actually serves - USER node, `npm ci` from the lockfile, `restart: unless-stopped`, and `data/.gitkeep` tracked so the Docker daemon never creates the bind source root-owned - a startup guard that names the path it cannot write, the uid it runs as, and a command that works — measured, pasted and re-run, not asserted - GET /v1/health reports the running build, read from package.json and never copied - version 1.0.0, repository/bugs/homepage, @types/node on the supported major - docs/API.md:18's stale count replaced by a four-item list - npm advisories 6 -> 0 Eight review rounds, twelve notes. Round 1 was blocking and correct: the reference deployment crash-looped on Linux, reproduced before it was fixed. Every round after it found a defect created by the round before — the guard stopping one line short of the failure it was for, a remedy compose does not expand, a claim about a cause the code could not know, a filter that dropped the commonest failure, a remedy naming a path never diagnosed, a container test decided from marker files. Three of the twelve were checks of mine that read something adjacent to the claim they stood for: my own comment, an import line, a neighbouring command. Refs #467 Co-Authored-By: Blake Bertuccelli-Booth <bbertucc@users.noreply.github.com> Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>