feat(edge): add offline read cache for allowlisted State Hub GET routes

The edge relay now persists successful GET responses and serves them with
stale markers when upstream is unreachable. Extend Forgejo image workflow
path filters so api changes trigger registry publishes.

docs/offline-write-buffer.md

@@ -84,6 +84,25 @@ or secret-looking JSON fields. Payloads over 64 KiB are rejected.
     statehub outbox retry ENVELOPE_ID
     statehub outbox cancel ENVELOPE_ID
 
+## Read Cache (Beachhead V1)
+
+The edge relay also keeps a small SQLite read cache for allowlisted `GET`
+routes used by activity-core context resolution and daily triage:
+
+- `/state/*`, `/workplans/*`, `/messages/*`, `/decisions/*`, `/tasks/*`,
+  `/progress/*`, `/sbom/*`, `/repos*`, `/legacy-meter/*`
+
+While upstream is reachable, successful `GET` responses are cached and marked
+`X-StateHub-Edge-Cache: hit`. When upstream is unreachable, the relay serves
+the last cached body with HTTP 200 and `X-StateHub-Edge-Cache: stale` plus
+`X-StateHub-Edge-Cache-Age`.
+
+Default cache path: `STATEHUB_READ_CACHE_PATH`, recommended alongside the
+outbox at `~/.statehub/edge-read-cache.sqlite3`.
+
+Uncached reads still return HTTP 503 during outage. Online-only `POST` routes
+remain queueable or rejected per the write allowlist above.
+
 ## Recovery Checklist
 
 1. Confirm the central State Hub API is reachable.