feat(relay): deploy from prebuilt multi-arch image

[bobleer]

Summary

• publish signed amd64/arm64 Relay Server images to GHCR for stable and nightly releases
• make Desktop one-click deploy install Docker when needed, then only pull and start the digest-pinned image
• route mainland China pulls through DaoCloud, NJU, then official GHCR; use official GHCR globally
• preserve volumes and container contract, with pull-before-stop and automatic rollback on start/health/cancel failures
• mirror the signed image descriptor to openbitfun.com and gate releases on anonymous pull access

Verification

• cargo check --workspace
• cargo test -p bitfun-services-integrations --features remote-ssh-concrete remote_ssh::relay_deploy --no-fail-fast (28 passed)
• pnpm run type-check:web
• pnpm run lint:web
• pnpm run i18n:audit
• pnpm run check:github-config
• pnpm run check:repo-hygiene
• node --test scripts/relay/package-contract.test.mjs
• bash -n for the modified deployment/sync scripts

The PR is intentionally left open for review.

[bobleer]

Published image verification

The v0.2.15 backfill completed successfully in Desktop Package run 30836946476.

• Public image: ghcr.io/gcwing/bitfun-relay-server
• Signed multi-platform digest: sha256:eae6a9fd705500d5d18be833e77287027c96d1b7a985d224a6f9032ec8ce9b9b
• Release descriptor: https://github.com/GCWing/BitFun/releases/download/v0.2.15/relay-image.json
• Runtime smoke: both linux/amd64 and QEMU linux/arm64 containers reached the image HEALTHCHECK healthy state
• Anonymous GHCR manifest access passed after logout
• NJU mainland route returned HTTP 200 for the same digest
• DaoCloud currently requires allowlisting; request #45885 and allowlist PR #45886 were submitted. Until accepted, China mode prefers the verified NJU route and automatically falls through DaoCloud to official GHCR.

The PR remains open as requested.