Add release/dev build scripts and branch-based deploy workflow

- scripts/release.sh: build from main, tag :latest + short SHA, push
  both. Aborts if not on main or working tree is dirty; warns on
  unpushed commits. Prevents dev states from becoming :latest.
- scripts/dev-build.sh: local dev image (tagged per branch), never
  pushed -- keeps development builds off the registry.
- docs/deployment.md: document branch/PR workflow, replace manual
  build/push steps with the scripts, SHA-based rollback now standard.
- .gitattributes: force LF on *.sh so the shebang works on Windows.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitattributes

@@ -0,0 +1,3 @@
+# Shell-Skripte brauchen Unix-Zeilenenden (LF), sonst scheitert der #!-Aufruf
+# in bash. Unabhaengig von core.autocrlf auf Windows erzwingen.
+*.sh text eol=lf