feat(tui+deploy): wire TUI to live ReasoningLoop via agent_bridge; add Docker deployment

Dockerfile

@@ -0,0 +1,31 @@
+# ── Stage 1: build ──────────────────────────────────────────────────────────
+FROM rust:1.82-slim AS builder
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    pkg-config \
+    libssl-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+COPY . .
+
+# Build the release binary in one layer so CI cache is maximally effective.
+RUN cargo build --release --bin sentinel
+
+# ── Stage 2: runtime ─────────────────────────────────────────────────────────
+FROM debian:bookworm-slim AS runtime
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    openssh-client \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=builder /app/target/release/sentinel /usr/local/bin/sentinel
+
+# Operators override these at runtime — never bake keys into the image.
+ENV ANTHROPIC_API_KEY="" \
+    OPENAI_API_KEY="" \
+    RUST_LOG="info"
+
+ENTRYPOINT ["sentinel"]
+CMD ["--help"]

docker-compose.yml

@@ -0,0 +1,15 @@
+services:
+  sentinel:
+    build: .
+    image: sentinel:latest
+    environment:
+      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:?ANTHROPIC_API_KEY must be set}
+      - OPENAI_API_KEY=${OPENAI_API_KEY:-}
+      - RUST_LOG=${RUST_LOG:-info}
+    # A PTY is required for the TUI and for the run command's stdin approval prompt.
+    stdin_open: true
+    tty: true
+    # Default: launch the TUI pointed at localhost.
+    # Override at run-time:
+    #   docker compose run sentinel run "check disk usage" --host myserver
+    command: tui --host localhost