v2 line: root takeover (compose-first) + release plumbing

[thomasboni]

Summary

Layout ruling: v2 takes over the repository root; v1 (Helm chart, Docker Compose with bundled
Traefik, podman, install.sh) moves into legacy-v1/ unchanged (see legacy-v1/README.md).
v2 is compose-first: a minimal root compose.yml (backend, frontend, postgres:18-alpine,
redis:7-alpine, no build: sections, named volumes, healthchecks) plus .env.example and a new
quick-start README.md. A v2 Helm chart is follow-up work, not in this PR - the README points at
legacy-v1/charts as the closest reference in the meantime.

What moved into legacy-v1/ (git-mv, byte-identical content): compose.yml,
compose.local.yml, .env.example, .env.local.example, configmap.yml.example,
configmap.local.yml.example, podman.yml.example, podman.local.yml.example, .docker/,
charts/, install.sh, scripts/, versions.env. .github/workflows/ci.yml and
.github/workflows/release.yml (v1's own Helm lint/chart-release pipeline) had their paths to
scripts//charts/ updated to the new legacy-v1/ location - no other change to either workflow,
v1's own CI/release behavior is otherwise untouched.

New at root: compose.yml, .env.example (PLATFORM_VERSION=v2.0.0 as the first line - this
is the exact contract the monorepo's release.yml sed step targets, do not rename that variable on
either side without updating the other), README.md (quick start: configure, docker compose up -d, plumber-bootstrap, then log in; the upgrade story; the legacy-v1 pointer).

New: .github/workflows/publish-release.yml - on a push to main where latest.json
changed, it reads the version, tags it, and runs gh release create with releases/<version>.md
as the notes file. This reacts to Thomas merging the monorepo's own release PR (which is the one
that bumps .env.example/latest.json/releases/<version>.md) - it never opens or approves
anything itself. releases/.gitkeep added so the directory exists ahead of the first release PR.

One deliberate deviation from the brief's literal wording: hardening comments in
compose.yml/.env.example are written self-contained rather than pointing at
docs/ops-notes.md - that file lives in the private getplumber/monorepo, unreachable from this
public repo, so a literal path reference would be broken/confusing for an external operator.

One thing this PR does NOT solve, flagged for review: compose.yml exposes backend and
frontend on two separate host ports; the frontend's browser-side code calls the API at the same
origin under /api with no client config (platform/frontend's own env.ts), which needs a
reverse proxy in front routing /api/* to backend and everything else to frontend on one public
hostname. This compose file deliberately does not bundle one (kept minimal, no Traefik) - both the
compose.yml comment on the frontend service and the README call this out explicitly so it isn't
silently missed at install time.

This PR is the prerequisite for the first v2.0.0 release run: the monorepo's on-demand
release.yml workflow opens its own release PR against this repo's .env.example/latest.json
using the exact paths this PR establishes.

Test plan

• docker compose --env-file <filled .env> -f compose.yml config resolves cleanly (verified
  locally with placeholder secrets - all four services, healthchecks, and env interpolation
  resolve as expected).
• YAML-valid: compose.yml, .github/workflows/publish-release.yml, and the edited
  ci.yml/release.yml all parse.
• Manual: run docker compose up -d against real images once v2.0.0 is published, confirm
  plumber-bootstrap flags match cmd/bootstrap's current flag set (verified against source,
  not run against a live image in this PR).
• Confirm legacy-v1/'s CI (ci.yml chart lint/unit tests, release.yml chart-releaser) still
  passes from its new legacy-v1/charts path.