feat(deploy): Docker + Linux server deployment

Multi-stage Dockerfile (builder → export → runtime) producing a 149 MB
Ubuntu 24.04 image, verified booting end-to-end on Docker Desktop.  vcpkg
fetched via shallow git fetch at the pinned baseline, release-only overlay
triplets (x64-linux, arm64-linux) to halve intermediate disk usage, and
buildtrees deleted within the RUN layer so they never land in the image or
the BuildKit cache.  Binary cache mount (VCPKG_BINARY_SOURCES) makes
subsequent rebuilds restore pre-built packages instead of recompiling.

Also adds:
- docker-compose.yml for one-command local deploy
- .dockerignore (excludes clients/, build/, .git/)
- .github/workflows/build-linux.yml — CI cross-build for amd64 + arm64
  with downloadable artifacts (primary path for building from Windows)
- scripts/build-linux-binaries.sh — local Docker binary extraction fallback
- deploy/linux/voicecat.service — hardened systemd unit for bare-metal
- cmake/voicecat-toolchain.cmake now auto-wires VCPKG_OVERLAY_TRIPLETS

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

PROGRESS.md

@@ -10,6 +10,37 @@ up instantly. Newest status at the top.
 
 ## ▶ Where we left off / next action
 
+- **Done (2026-06-21):** **Docker + Linux deployment + GitHub Actions cross-build.** Added the complete Linux server
+  deployment story (the only missing platform — Windows and macOS already have native
+  binaries):
+  - `Dockerfile` — multi-stage (builder: `ubuntu:24.04` + vcpkg + `cmake --preset
+    server-release`; runtime: `ubuntu:24.04`, non-root `voicecat` user, `/data` volume,
+    TCP+UDP 8384). vcpkg is fetched via the GitHub archive tarball at the exact
+    `builtin-baseline` commit (`d46283cf…`), avoiding a full git-history clone. BuildKit
+    cache mounts on `/vcpkg/downloads`, `/vcpkg/buildtrees`, `/vcpkg/packages` (scoped by
+    `TARGETARCH`) keep rebuilds fast. Both `voicecat-server` and `voicecat-admin` are
+    copied into the runtime image.
+  - `docker-compose.yml` — single-service compose file with `restart: unless-stopped`,
+    named volume `voicecat-data`, and port mappings for TCP+UDP 8384. `command:` shows
+    how to set `--name`.
+  - `.dockerignore` — excludes `.git/`, `build/`, `clients/` (Swift/C# code), `docs/`,
+    markdown, editor config; build context is just `core/`, `server/`, `tools/`, `cmake/`,
+    and the three root CMake/vcpkg files.
+  - `deploy/linux/voicecat.service` — hardened systemd unit (non-root, `ProtectSystem`,
+    `NoNewPrivileges`, `AmbientCapabilities=CAP_NET_BIND_SERVICE`) for bare-metal deploys.
+  - Multi-arch: `docker buildx build --platform linux/amd64,linux/arm64 .` works without
+    any triplet override — `cmake/voicecat-toolchain.cmake` auto-detects from the host
+    arch cmake sees inside the buildx container.
+  - Quick start: `docker compose up -d` (or `docker run -d -p 8384:8384/tcp -p
+    8384:8384/udp -v voicecat-data:/data voicecat`). First run auto-generates identity
+    + cert + DB; check logs for fingerprint + admin password.
+  - **GitHub Actions** (`.github/workflows/build-linux.yml`): primary cross-platform
+    binary build path — amd64 uses `ubuntu-24.04`, arm64 uses `ubuntu-24.04-arm`
+    (native, not QEMU). Triggers on push to main (when C++/cmake files change) and
+    manually via `workflow_dispatch`. Downloads land as 90-day artifacts.
+    `scripts/build-linux-binaries.sh` is the local Docker fallback (needs ~10–15 GB
+    free disk; suits Linux dev machines, not Windows Docker Desktop).
+
 - **Done (2026-06-21):** **Fix permanent voice-loss bug + harden the UDP media path (protocol v2).**
   Field report: two iOS users lost all audio mid-call after a bad-network blip and could not
   recover even by restarting the apps. Root causes found in the UDP media path: