#11 Docker build-on-start + dogfood + polish

Context: hu13 must be host-anywhere: one image, build-on-start, two mounts. Tasks:

• Dockerfile: rust build stage (locked deps) + minimal runtime; entrypoint: hu13 build /data/repo -o /srv/www (fail loud on bad branch) then exec hu13 serve. Expose 39313. No nginx inside. .dockerignore (target, dist, inbox).
• Documented run: -v ./repo:/data/repo:ro -v ./inbox-vol:/data/inbox -p 39313:39313. Restart = rebuild.
• Polish: empty states ("none yet"), 404 page, header metadata, CSS check (<15KB), binary size check (<2MB or cut list), border-radius: 0 grep.
• Dogfood: build+serve THIS repo; supervisor browses every tab; file 3+ polish issues found (or record "none found"). Success rubric (dod §Ship minus license):
• Fresh container from clean image serves code/commits/issues/pulls/tasks/ci/releases/wiki + feed + api on first boot with no manual steps.
• Replace repo contents + restart -> new sha shown; inbox files survive restart.
• fmt/clippy/test/ci green; CSS + binary budgets met. Swarm: Owl + supervisor dogfood session. Branch m5/docker.