v1.0.0:3 — post-cutover seed strip

Removes the one-time `/data` snapshot from the deployed Docker image now
that the cutover from the legacy `workout-log` package is verified done
(v1.0.0:1 + :2 in production).

Dockerfile
- Drops `COPY start9/0.4/seed/data /app/seed/data`.
- Drops the `WORKOUT_BAKED_SEED_DB_PATH` env var.
- Comment block explains the rationale + how to re-seed if ever needed.

docker_entrypoint.sh
- Step 1 collapses to single-branch fallback: if /data is empty AND
  /app/prisma/data/app.db exists, copy the empty-schema fallback. The
  baked-seed branch is gone.
- Comment cross-references v1.0.0:3 for the rationale.

start9/0.4/seed/README.md rewritten to reflect historical-only status
+ how to re-seed for the rare "spin up another instance with this
history" case.

Version graph
- Adds startos/versions/v1.0.0.3.ts with empty up/down migrations and
  release notes.
- Promotes v1.0.0:3 to `current`; v1.0.0:1 and :2 move to `other` so
  hosts on either upgrade in place.

No schema changes, no data migration. /data on existing installs is
left exactly as-is. Image size drops by ~1.7MB (the snapshot size).

start9/0.4/Dockerfile

@@ -8,18 +8,21 @@
 # This Dockerfile is self-contained: it references only files under
 # `proof-of-work/` (the upstream app) and `start9/0.4/` (this wrapper).
 #
-# Data preservation (v1.0.0:1 — initial seeded cutover):
-#   - This image bakes a one-time snapshot of the maintainer's live /data
-#     volume under /app/seed/data so the cutover from the legacy `workout-log`
-#     package preserves every workout, exercise, and preference.
-#   - docker_entrypoint.sh copies the seed into the StartOS-managed /data
-#     volume only on a truly-fresh first boot (both /data/app.db missing AND
-#     /data/.seeded absent). Every subsequent boot leaves /data alone.
-#   - v1.0.0:2 will strip the seed copy from the image and the seed-copy
-#     branch from the entrypoint once the cutover is verified in production.
-#   - A tiny empty-schema fallback DB is also COPYed from the builder stage
-#     (at /app/prisma/data/app.db) as a safety net for fresh sideloads on a
-#     brand-new host with no existing /data and no baked seed.
+# Data preservation (v1.0.0:3 — post-cutover):
+#   - The image NO LONGER bakes a /data seed. The one-time cutover from
+#     the legacy `workout-log` package happened in v1.0.0:1, was verified
+#     in v1.0.0:2, and /data on the live host is now the sole source of
+#     truth. Removing the baked seed from the image eliminates any
+#     possibility of a future bug accidentally overwriting live data.
+#   - docker_entrypoint.sh's seed-copy branch is stripped to match.
+#   - The empty-schema fallback DB at /app/prisma/data/app.db is kept —
+#     it's still useful for brand-new sideloads on a host that has never
+#     had proof-of-work installed before. The build-time `npm run db:seed`
+#     populates it with the curated exercise library + admin@local user.
+#   - The seed snapshot itself stays on disk under start9/0.4/seed/data/
+#     as a historical artifact; it's just not COPYed into the image. If
+#     you ever need to re-seed (e.g. spinning up a new instance with
+#     pre-loaded history), reintroduce the COPY line and rebuild.
 
 FROM node:20-alpine AS builder
 
@@ -61,7 +64,6 @@ ENV NODE_ENV=production \
     WORKOUT_DATA_DIR=/data \
     WORKOUT_DB_PATH=/data/app.db \
     WORKOUT_FALLBACK_SEED_DB_PATH=/app/prisma/data/app.db \
-    WORKOUT_BAKED_SEED_DB_PATH=/app/seed/data/app.db \
     WORKOUT_LIBRARY_JSON_PATH=/app/prisma/exercises.seed.json
 
 # Next.js standalone runtime bundle
@@ -75,14 +77,16 @@ COPY --from=builder --chown=nextjs:nodejs /app/prisma ./prisma
 # bundling failures here surface as auth being silently broken at boot.
 COPY --from=builder --chown=nextjs:nodejs /app/node_modules/bcrypt ./node_modules/bcrypt
 
-# Empty-schema fallback DB (used only when no baked seed is available on a
-# brand-new sideload).
+# Empty-schema fallback DB. Used only on brand-new sideloads where /data
+# is empty and no admin user exists yet. Build-time `npm run db:seed`
+# populated it with the curated exercise library + admin@local. Existing
+# installs always have /data/app.db so this branch never fires.
 COPY --from=builder --chown=nextjs:nodejs /tmp-seed/app.db /app/prisma/data/app.db
 
-# Baked one-time cutover seed: the maintainer's live /data snapshot pulled
-# off the running `workout-log` host via refresh_seed.sh. Copied into /data
-# only on truly-fresh first boot. Removed in v1.0.0:2.
-COPY --chown=nextjs:nodejs start9/0.4/seed/data /app/seed/data
+# (v1.0.0:3 removed the COPY of start9/0.4/seed/data into /app/seed/data.
+#  The baked cutover seed served its one-time purpose during v1.0.0:1's
+#  cutover and is no longer needed; eliminating it removes any chance of
+#  a future bug overwriting live /data.)
 
 # Container entrypoint and diagnostic healthcheck
 COPY start9/0.4/docker_entrypoint.sh /usr/local/bin/docker_entrypoint.sh