fix(docker): make SARIF upload non-blocking; correct seed-admin/build-stage/restore ownership docs

Final whole-branch review (opus) fixes:
- docker-publish.yml: upload-sarif was if:always() but not continue-on-error, so a
  Trivy SARIF-emit flake would fail the job and SKIP the multi-arch publish. Made it
  non-blocking so a scanner hiccup never blocks a release.
- deployment.md: seed-admin-rotated.txt is root-owned (written via docker exec, which
  bypasses the gosu drop) — reverted an over-correction. Corrected the canonical
  runtime-stage build description (no toolchain; non-root gosu). First-boot chown note.
- restore.sh: comment ownership root -> uid 1000.

.github/workflows/docker-publish.yml

@@ -108,6 +108,7 @@ jobs:
 
       - name: Upload Trivy image SARIF
         if: always()
+        continue-on-error: true # a scanner/SARIF-emit flake must never skip the publish below
         uses: github/codeql-action/upload-sarif@02c5e83432fe5497fd85b873b6c9f16a8578e1d9 # v3.37.0
         with:
           sarif_file: trivy-image.sarif