Public-flip audit: env-driven paths, scrub audit-ticket prefixes, terser README

Lucy bind paths + LAN host pins replaced with env defaults. Repository URLs
→ git.sulkta.com. Audit-changelog scaffolding stripped from inline comments
(technical reasoning preserved). README sheds marketing scaffolding. AI-speak
in load-bearing prompts/SOULs left alone — that IS the product.

Dockerfile

@@ -1,26 +1,16 @@
-# Multi-stage build for skald.
+# Multi-stage build for skald. Postgres ships in the same image
+# until the tool stabilises; to split, swap the runtime base to
+# debian:bookworm-slim, drop entrypoint.sh, point DATABASE_URL at
+# an external pg.
 #
-# Stage 1: compile the rust binary against rust:1-bookworm.
-# Stage 2: pgvector/pgvector:pg17 (debian-bookworm postgres with
-#          pgvector preinstalled) + tini + the skald binary.
-#
-# v0.1 ships postgres inside the same container ("singleton till we
-# have a real working tool"). When we extract the DB out, swap the
-# runtime base to debian:bookworm-slim, drop entrypoint.sh, point
-# DATABASE_URL at the external pg.
-#
-# Build context is the workspace root:
-#   docker build -t skald:latest .
+# Build context is the workspace root: `docker build -t skald:latest .`
 
-# ─── builder ──────────────────────────────────────────────────────
 FROM rust:1.95-bookworm AS builder
 WORKDIR /build
 
-# Cache the dependency graph: copy manifests first, fetch + build
-# stubs, THEN drop in real sources. The vendored clawdforge SDK
-# needs its own manifest + source available during the cache layer
-# (path dep — Cargo resolves it at workspace load time, not at
-# crate-compile time).
+# Dependency-cache layer: copy manifests + vendored path-dep first,
+# build stubs, then drop in real sources. clawdforge is a path dep
+# resolved at workspace load time.
 COPY Cargo.toml Cargo.lock ./
 COPY skald-core/Cargo.toml skald-core/Cargo.toml
 COPY skald/Cargo.toml      skald/Cargo.toml