infra: container-only workflow (packaging image + scripts); README: add No Host Pollution policy

docker/packaging/Dockerfile

@@ -0,0 +1,17 @@
+FROM docker:26-cli
+
+# Install tools needed for Cloudron packaging inside the container
+RUN apk add --no-cache \
+    bash git curl jq \
+    build-base \
+    nodejs npm \
+    openssh-client
+
+# Cloudron CLI (used for packaging commands)
+RUN npm i -g cloudron
+
+WORKDIR /workspace
+
+# Default command keeps the container running
+CMD ["sh", "-lc", "tail -f /dev/null"]
+