feat(lab10): GHCR release on tag, HF Spaces deploy, tunnel bonus

[blacktree-lab]

Goal

Ship QuickNotes to a real registry + hosted platform: a tag-triggered CI push to GHCR, a public Hugging Face Space, and (bonus) a Cloudflare Tunnel with an internal-vs-external latency comparison.

Changes

• .github/workflows/release.yml - on a v* tag: build ./app and push ghcr.io/blacktree-lab/devops-intro/quicknotes tagged <version> + latest; packages: write only; all third-party actions SHA-pinned
• app/Dockerfile - multi-stage distroless build (brought onto this branch; main didn't track it)
• submissions/lab10.md - workflow, GHCR clean-pull proof, HF Space files, latency measurements, design answers a–i
• Hugging Face Space BarberryML/quicknotes (Docker SDK, app_port: 8080, pulls the GHCR image)

Testing

• Tag v0.1.0 -> release workflow green; image at ghcr.io/blacktree-lab/devops-intro/quicknotes:0.1.0 + :latest, package public
• docker logout ghcr.io && docker pull …:0.1.0 succeeds with no auth -> publicly pullable; /health OK
• HF Space Running at https://barberryml-quicknotes.hf.space; /health + /notes return JSON; warm p50 2.65 s; 3 cold-start samples after 35-min idle
• Bonus: same image via a Cloudflare quick tunnel, verified from a phone on cellular; warm p50 1.67 s / p95 3.10 s. Finding: hosted HF (2.65 s) was slower than the local-via-edge tunnel (1.67 s) from Melbourne, distance + platform overhead dominate

Notes

• HF DATA_PATH points at /tmp because HF runs Space containers as UID 1000 (can't write the image's /data, owned by distroless uid 65532)

Checklist

• Tag -> CI -> image in GHCR, publicline
• All third-party actions SHA-pinned; packages: write only
• HF Space serves at public URL; a/notes` work
• Cold-vs-warm latency: 3 cold samples recorded (in progress — 35-min idle cycles)
• Bonus: tunnel reachable from anotle + failure-mode analysis
• Design questions a–i answered
• Commits are signed