Finalize Ouroboros production package bundles

[den-sq]

Summary

Finalizes Ouroboros production package bundle inputs.

• Renames package flavors to core, with-plugins-cpu, and with-plugins-cuda.
• Pins Neuroglancer to v1.0.0 / release.zip.
• Pins automatic segmentation to v0.4.0-beta CPU/CUDA release assets.
• Records exact plugin release tags/artifacts and plugin release metadata in package-flavor.json.
• Updates production package flavor documentation.

Closes #93.

Validation

• Fix-to-staging PR Finalize production package pins and flavor names #94 passed.
• Staging smoke tag: v1.4.0-packaging-smoke.6
• Build and Release App run passed: https://github.com/ChengLabResearch/ouroboros/actions/runs/28620206040
• Publish Server Image run passed: https://github.com/ChengLabResearch/ouroboros/actions/runs/28620206592

[tavateva]

✅ READY

Issue coverage: Closes #93 (Finalize production packaging bundles). Closes the remaining ? items on the project board.

What's here:

Workflow: The build-and-release.yml refactor is the centerpiece. The old workflow built a Python wheel and Poetry install on every platform; this replaces that entirely with a registry-backed server (prepare:production-server) — consistent with #90/#91/#92 already merged. The matrix is now 3 platforms × {core, with-plugins-cpu, with-plugins-cuda} = 9 build jobs. fail-fast: false is correct (don't abort all builds if one platform fails). build-packages carries only contents: read; the separate release job (gated on needs: build-packages) carries contents: write — correct least-privilege split.

Plugin pins: Neuroglancer v1.0.0 / release.zip (legacy asset, documented in neuroglancer-plugin PR #8 as not including plugin-release.json) and autoseg v0.4.0-beta / auto-segmentation-v0.4.0-beta-{cpu,cuda}.zip. Both are overridable via workflow_dispatch inputs, which is the right escape hatch for future bumps without a code change.

Token: secrets.OUROBOROS_RELEASE_ASSET_TOKEN || secrets.GITHUB_TOKEN — correct; needed for cross-repo release asset downloads when plugin repos are private.

Scripts: prepare-production-server.mjs, prepare-package-flavor.mjs, rename-release-artifacts.mjs cover the three-step package build. .package-plugin-artifacts local dir added to .gitignore for local testing.

App code: src/main/plugins.ts (108 lines) adds bundled plugin install-on-startup from preinstalled-plugins/; schemas.ts gets the matching schema entry. This is what makes the with-plugins-* flavors actually install the bundled plugins at first launch.

Documentation: New production-package-flavors.md documents all three flavor definitions, release inputs, and local check commands. registry-server-images.md updated to match the new prepare:production-server script interface.

Staging validation: Smoke tag v1.4.0-packaging-smoke.6 exercised the full 9-job matrix; Build and Release App + Publish Server Image both passed.

CI (on HEAD): coverage ✅, docs ✅, release ✅, server-image ✅, test-coverage ✅.

No issues found.