feat(deploy): Docker + Linux server deployment

Multi-stage Dockerfile (builder → export → runtime) producing a 149 MB
Ubuntu 24.04 image, verified booting end-to-end on Docker Desktop.  vcpkg
fetched via shallow git fetch at the pinned baseline, release-only overlay
triplets (x64-linux, arm64-linux) to halve intermediate disk usage, and
buildtrees deleted within the RUN layer so they never land in the image or
the BuildKit cache.  Binary cache mount (VCPKG_BINARY_SOURCES) makes
subsequent rebuilds restore pre-built packages instead of recompiling.

Also adds:
- docker-compose.yml for one-command local deploy
- .dockerignore (excludes clients/, build/, .git/)
- .github/workflows/build-linux.yml — CI cross-build for amd64 + arm64
  with downloadable artifacts (primary path for building from Windows)
- scripts/build-linux-binaries.sh — local Docker binary extraction fallback
- deploy/linux/voicecat.service — hardened systemd unit for bare-metal
- cmake/voicecat-toolchain.cmake now auto-wires VCPKG_OVERLAY_TRIPLETS

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

deploy/linux/voicecat.service

@@ -0,0 +1,23 @@
+[Unit]
+Description=VoiceCat Voice & Text Server
+Documentation=https://github.com/org/voicecat
+After=network.target
+
+[Service]
+Type=simple
+User=voicecat
+Group=voicecat
+ExecStart=/usr/local/bin/voicecat-server --data-dir /var/lib/voicecat
+Restart=on-failure
+RestartSec=5s
+# Allow binding port 8384 without running as root
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+# Harden the process
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/var/lib/voicecat
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target