feat: Docker support with GHCR publishing

[marianfoo]

Summary

Adds Docker support for running vsp as a containerised MCP server, published automatically to GitHub Container Registry (GHCR) — no Docker Hub account required.

• Dockerfile — multi-stage build (golang:1.23-alpine builder with CGO, alpine:3.21 runtime); non-root user; version/commit/date injection via --build-arg
• .dockerignore — excludes credentials, reports, IDE/git files from build context
• .github/workflows/docker.yml — triggers on v* tag push (same event fired by release.yml); builds linux/amd64 + linux/arm64; pushes to ghcr.io/oisee/vsp; uses built-in GITHUB_TOKEN with packages: write — no extra secrets
• docs/docker.md — comprehensive guide: all SAP_* env vars, safety modes, tool groups, feature flags, network/TLS, MCP client (Claude Desktop) integration, update workflow
• reports/2026-03-13-001-docker-support.md — design record

Blocker / Why Draft

HTTP streamable MCP transport is not yet implemented.

The current vsp MCP server communicates exclusively over stdio (stdin/stdout). Docker works for this today — docker run -i pipes stdio to the MCP client — but it is an awkward integration:

• MCP clients must spawn a docker run subprocess per session
• No persistent container, no health checks, no port-based routing
• Teams running vsp on a shared server can't serve multiple clients without a sidecar

Once HTTP streamable transport (see #38 ) lands, a Docker container becomes far more natural: expose a port, run as a long-lived service, route multiple MCP clients to the same instance. The Dockerfile and workflow are ready for that — only the vsp server code needs the transport layer.

No changes to release.yml

docker.yml self-triggers from the tag push that release.yml already performs. The two workflows run in parallel with independent permission scopes.

Test plan

• docker build -t vsp . completes without error
• docker run --rm vsp --version prints version
• docker run -i --rm -e SAP_URL=... -e SAP_USER=... -e SAP_PASSWORD=... vsp connects to SAP system
• On tag push: docker.yml workflow runs and image appears at ghcr.io/oisee/vsp
• docker pull ghcr.io/oisee/vsp:latest works on both amd64 and arm64

🤖 Generated with Claude Code