docs: document both deploy paths, registry knobs, measured resource usage

README + deployment guide now show three ways to run RoboCo — pull the
pre-built images (docker-compose.registry.yml), build from source, or the
local-dev flow — instead of only the dev path. Add the ROBOCO_REGISTRY /
ROBOCO_VERSION knobs and the required ROBOCO_ENCRYPTION_KEY (which was
missing) to .env.example, and fix a stale piragi reference there.

usage.md drops the unmeasured per-agent RAM ceiling and records the figures
measured on the live stack: RAM is low and Ollama-dominated, storage is the
real cost (images share the agent-base layer). Idle numbers — peak under an
active task is best read live with docker stats.

.env.example

@@ -21,6 +21,16 @@
 # Claude auth directory to mount into orchestrator
 # CLAUDE_AUTH_DIR=~/.claude
 
+# =============================================================================
+# Container Images (docker-compose.registry.yml — pre-built deployment)
+# =============================================================================
+# Only used by docker-compose.registry.yml, which runs the published images
+# instead of building from source. Defaults shown.
+# Registry namespace: ghcr.io/rennf93 (GHCR) or docker.io/renzof93 (Docker Hub)
+# ROBOCO_REGISTRY=ghcr.io/rennf93
+# Image tag: latest, or a pinned release such as 0.5.0
+# ROBOCO_VERSION=latest
+
 # =============================================================================
 # Data Persistence
 # =============================================================================
@@ -65,7 +75,7 @@ ROBOCO_REDIS_DB=0
 # ROBOCO_REDIS_PASSWORD=
 
 # =============================================================================
-# RAG / Local LLM (Ollama + pgvector via piragi)
+# RAG / Local LLM (Ollama + in-house pgvector engine)
 # =============================================================================
 # For docker compose use the container name (roboco-ollama); locally, localhost.
 ROBOCO_OLLAMA_BASE_URL=http://localhost:11434
@@ -76,6 +86,11 @@ ROBOCO_DEFAULT_EMBEDDING_MODEL=qwen3-embedding:0.6b
 # =============================================================================
 # Security
 # =============================================================================
+# Encryption key for git tokens at rest (Fernet). REQUIRED — the orchestrator
+# refuses to start without it. Generate with:
+#   python -c 'from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())'
+ROBOCO_ENCRYPTION_KEY=
+
 # Agent auth: HMAC secret that signs X-Agent-Token. REQUIRED for docker compose.
 # Generate with: python -c 'import secrets; print(secrets.token_hex(32))'
 ROBOCO_AGENT_AUTH_SECRET=