CI: GitHub Actions build and release workflows

- build.yml: runs on push to main, builds Docker image + packs s9pk,
  uploads artifact
- release.yml: runs on version tags (v*.*), builds and creates GitHub
  release with s9pk attached
- Dockerfile: build context is repo root (docker build -f deploy/Dockerfile .)
- Manifest: switched to dockerTag (pre-built image pattern)
- Makefile + s9pk.mk: local build support

.github/workflows/build.yml

@@ -0,0 +1,74 @@
+name: Build Service
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths-ignore: ['*.md']
+    branches: ['main']
+  push:
+    paths-ignore: ['*.md']
+    branches: ['main']
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      packages: read
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y squashfs-tools-ng
+
+      - name: Install start-cli
+        run: |
+          curl -fsSL -o start-cli https://github.com/Start9Labs/start-os/releases/download/v0.4.0-alpha.20/start-cli_x86_64-linux
+          chmod +x start-cli
+          sudo mv start-cli /usr/local/bin/
+          start-cli --version
+
+      - name: Initialize developer key
+        env:
+          DEV_KEY: ${{ secrets.DEV_KEY }}
+        run: |
+          if [ -n "$DEV_KEY" ]; then
+            mkdir -p ~/.startos
+            echo "$DEV_KEY" > ~/.startos/developer.key.pem
+          else
+            start-cli init-key
+          fi
+
+      - name: Build Docker image
+        run: docker build -f deploy/Dockerfile -t ten31portal:local .
+
+      - name: Install StartOS packaging deps
+        working-directory: deploy
+        run: npm ci
+
+      - name: Build StartOS JavaScript
+        working-directory: deploy
+        run: npm run build
+
+      - name: Pack s9pk
+        working-directory: deploy
+        run: start-cli s9pk pack --arch x86_64 --license ../LICENSE -o ten31portal.s9pk
+
+      - name: Upload s9pk artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ten31portal-s9pk
+          path: deploy/ten31portal.s9pk