Add Dockerfile for coulomb-social delivery-lane packaging

Non-root gunicorn image with /healthz check; railiance-apps values still open.

docs/deploy.md

@@ -19,7 +19,18 @@ railiance01 (same lane as `vergabe-teilnahme`).
 
 - `GET /healthz` → `{"status":"ok"}`
 
+## Build
+
+```bash
+SHA=$(git rev-parse --short HEAD)
+docker build -t forgejo.coulomb.social/coulomb/coulomb-social:$SHA .
+```
+
+Runtime env (no secrets in image): `SECRET_KEY`, `DATABASE_URL`,
+`OIDC_*`, `USER_ENGINE_*`, `DEFAULT_TENANT_ID`, `ALLOWED_HOSTS`.
+
 ## Status
 
-Container packaging and railiance-apps values are **not** finished; local
-`runserver` / tests are the current verification path.
+- Dockerfile present (gunicorn, non-root, `/healthz` check).
+- railiance-apps Helm values / cluster Service **not** yet landed.
+- Local `make run` + `make test` remain the default verification path.