[eigmax]

Summary

• The release workflow builds and pushes ghcr.io/projectzkm/zkm-fleet-scheduler:<version> instead of uploading a docker save tarball as a release asset.
• docker-compose.yml drops its build: section and :local default; FLEET_SCHEDULER_IMAGE is now required, so a missing value fails with a clear error.
• install.sh records the image in compose.env; setup.sh pulls it for the control role.
• fleet-ctl.sh scheduler upgrade pulls the image first (a missing image changes nothing), records it in compose.env, and recreates the services. Rollback restores the backed-up compose.env, so the :rollback tag handling is gone.
• installation.md and maintenance.md describe the GHCR flow.

Before the first release with this change

• The GHCR package must be set to Public after the first push (package settings), or curl | bash installs and fleet-ctl.sh upgrades cannot pull it.
• No image exists for v0.1.1 or earlier, so scheduler upgrade v0.1.1 would fail at the pull. Publish a new tag from this change.

Validation

• bash -n on the three scripts, YAML parse of the workflow and compose file.
• docker compose config fails with the intended message when the image variable is unset and renders both services when it is set.
• fleet-ctl.sh -n scheduler upgrade dry run against a scratch prefix.
• bridge and deploy tests: 70 passed.
• Not tested: the registry push and pull themselves.