feat(distribution): production install/update/backup scripts + public-repo sync (#106)

Builds the customer-facing distribution: a curated distribution/ directory
containing only what an end customer needs (production docker-compose.yml
with no build: sections, install.sh/update.sh/uninstall.sh/healthcheck.sh/
backup.sh/restore.sh, a customer-facing CHANGELOG.md, and README/LICENSE/
NOTICE/THIRD_PARTY_LICENSES) — pushed as the initial content of the new
public alleyviper/argus repo.

install.sh: detects OS, validates Docker/Compose, fetches all deployment
files, generates a secure DB password, creates the required Docker
network, pulls images, starts the stack, waits for health, and rotates
the default admin/admin credentials via the auth API — printing the
generated password once at the end.

update.sh/healthcheck.sh/backup.sh/restore.sh/uninstall.sh formalize what
was previously ad-hoc README snippets into real, safe-by-default scripts
(uninstall.sh keeps data unless --remove-data is explicitly passed and
confirmed; restore.sh requires typed confirmation and documents that it
targets a fresh install, not a live merge).

Added a sync-distribution job to release.yml: after a successful release,
mirrors distribution/ into the public repo and creates a matching
(customer-facing, commit-log-free) release marker there. Needs a one-time
setup step — a fine-grained PAT scoped to alleyviper/argus added as the
ARGUS_PUBLIC_REPO_TOKEN secret — the job cleanly no-ops until that's added.

Not yet done: GHCR package visibility (argus-secure-api/-ui/-nginx) is
still private, which blocks a genuine end-to-end curl-install test from a
clean, unauthenticated environment — deferred at the user's request until
they flip it manually (GitHub does not expose this via API).

CHANGELOG.md

@@ -0,0 +1,31 @@
+# Changelog
+
+All notable changes to ARGUS are documented here, in plain language for operators.
+Versioning follows [Semantic Versioning](https://semver.org/).
+
+## [3.29.0] — 2026-07-19
+
+### Security
+- Hardened the Challenge Engine's internal signing so a rare startup condition can no
+  longer weaken bot-challenge verification.
+- Updated bundled build tooling to close several third-party dependency advisories.
+
+## [3.28.0] — 2026-07-19
+
+### Added
+- DNS Protection settings now include contextual help explaining what each detector and
+  threshold does, so you can tune it with confidence instead of guessing.
+
+## [3.27.0] — 2026-07-19
+
+### Added
+- Complete user-management workflow: edit user details, admin-initiated password resets,
+  MFA reset, account lock/unlock, session management, and login history — all from one
+  panel per user.
+- Redesigned Attack Origin visualization: a single live global map (previously two separate,
+  inconsistent views) showing real-time attack traffic with per-event detail on demand.
+
+## [3.26.0] and earlier
+
+Earlier release history predates this distribution's changelog. See the GitHub Releases
+page for this repository going forward — every release from here on is documented here.