fix: README, .env.example, ErrorBoundary, client-logger, HEALTHCHECK, Docker hygiene

- README: version v0.2.6.8, corrected stale gate claim, updated changelog
- .env.example: merged two competing files into one, deleted bootstrap duplicate
- ErrorBoundary: new component wrapping app, prevents white-screen crashes
- Layout sidebar: version display from /api/health, Docs link to GitHub
- client-logger: debug/trace logger gated behind localStorage.redflag_debug=1,
  routes through existing /logs/client-error server endpoint (ETHOS #1)
- All web console.log calls rerouted through client-logger instead of deleted
- Server health endpoint returns version field
- Server accepts client_debug/client_trace in error_type validation
- Dockerfiles: pinned alpine:latest->3.21, nginx:alpine->1.27-alpine,
  added HEALTHCHECK directives
- docker-compose: healthcheck blocks for server and web services
- .dockerignore: created to slim Docker build context

README.md

@@ -2,7 +2,7 @@
 
 **Self-hosted update management for operators who own their stack.**
 
-`v0.2.6.6` — June 2026 · MIT License
+`v0.2.6.8` — June 2026 · MIT License
 
 > **You're early — over 1,000 of you cloned this before it was announced.**
 > A stable release is coming soon, bringing Windows support back fully gated.
@@ -148,7 +148,7 @@ Before a package is installed: the agent fetches the expected SHA-256 from the s
 
 ## Status
 
-**Compiles, runs on the maintainer's stack, not yet battle-tested.** No live deployment outside the dev environment. The gate (supply-chain verification) has not completed a full end-to-end run against real infrastructure. Treat everything below as "implemented and locally exercised, not production-proven."
+**Compiles, runs on the maintainer's stack, not yet battle-tested.** No live deployment outside the dev environment. The supply-chain gate has completed an end-to-end run (2026-06-05: `hyprutils` through capability-token minting, helper verification, and install on a live Fedora agent). Treat everything below as "implemented and locally exercised, not production-proven."
 
 **Implemented:**
 - Linux and Windows agent registration and update management
@@ -256,7 +256,7 @@ I am a Systems Architect with 25 years on the frontier. I build sovereign agent
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history. Recent highlights:
 
-**v0.2.6.6** — Windows agent service logging treats `agent.log` as the primary sink, even when service console handles are unavailable.
+**v0.2.6.8** — Dark/light tray app theme, desktop tray spine, prototype Tauri desktop app.
 
 **v0.2.6.5** — Windows agent service logs now write to `C:\ProgramData\RedFlag\logs\agent.log`.