fix(docker): make SARIF upload non-blocking; correct seed-admin/build-stage/restore ownership docs

Final whole-branch review (opus) fixes:
- docker-publish.yml: upload-sarif was if:always() but not continue-on-error, so a
  Trivy SARIF-emit flake would fail the job and SKIP the multi-arch publish. Made it
  non-blocking so a scanner hiccup never blocks a release.
- deployment.md: seed-admin-rotated.txt is root-owned (written via docker exec, which
  bypasses the gosu drop) — reverted an over-correction. Corrected the canonical
  runtime-stage build description (no toolchain; non-root gosu). First-boot chown note.
- restore.sh: comment ownership root -> uid 1000.

restore.sh

@@ -47,8 +47,9 @@ read -rp "Continue? [y/N] " yn
 echo "[1/3] Stopping backspace container..."
 docker compose stop backspace
 
-# data/backspace.db and data/backups/ are container-owned (root). The host user cannot
-# cp/rm them directly, so do the swap inside a throwaway root container that mounts data/.
+# data/backspace.db and data/backups/ are container-owned (uid 1000, the non-root runtime
+# user). The host user cannot cp/rm them directly, so do the swap inside a throwaway root
+# container that mounts data/ (root can rewrite the uid-1000-owned files).
 # (youruser is in the docker group on both boxes — no sudo prompt.)
 TS="$(date -u +%Y%m%dT%H%M%S)"
 echo "[2/3] Swapping DB inside a root container (pre-restore copy + WAL clear + install)..."