docs(deploy): document the vogt-stack tag taxonomy (lean releases vs full branch builds)

[thedancingdeveloper]

Adds a tag-taxonomy table to docs/DEPLOYMENT.md §7, next to the existing "release digests are CLI-free" policy: which vogt-stack tag families exist, who builds them, which pod-base variant they carry, and the plain warning that a deployment running agent sessions must never pin the semver/latest release stack (it comes up with no agent CLIs — session templates register but cannot start).

Documentation half of #502; the registry-side remedies (drop latest, variant labels, or split names) stay on the issue.

🤖 Generated with Claude Code

[thedancingdeveloper]

Closing: the premise this documents is being inverted, not refined.

The table here states the release stack carries no agent CLIs ("CLI-free by policy") and warns that a deployment running agent sessions should pin a full-variant branch digest rather than a release tag. feat/generic-aio makes both statements false — release.yml now builds with INSTALL_AI_CLIENTS=true and INSTALL_CADASTRE_MCP=false, so a release digest carries claude and codex and is the artifact a consumer is meant to pin.

The underlying observation was right, and the corrected table ships on that branch. The axis just moves: both families carry the CLIs, and what separates them is whether they also carry the estate.

Tag family	Built by	Pod base	Carries	Meant for
X.Y.Z, X.Y, sha-<short>, latest	release.yml	lean	claude, codex	the signed public artifact
dev, dev-<longsha>, prod-<longsha>	build.yml	full	the above, plus Flutter/Android SDK, Cadastre MCP, theclawbay	the maintainer's own pods

Because the release stack becomes the supported public AIO, the guidance reverses too: the release family is now the one to pin, and the branch family is a private deployment's image rather than a "fuller" release.

Superseded by feat/generic-aio. See #502 for why the issue behind this closes as well.

[thedancingdeveloper]

Superseded by feat/generic-aio — see the comment above.