fix(infra): release builds all 17 registry images; pg_dump backup sidecar (#461)

* fix(infra): release builds all 17 registry images; pg_dump backup sidecar

release.yml was missing roboco-agent-grok-prompter and
roboco-agent-grok-secretary (both FROM the bare local roboco-agent-grok
tag, so agent-grok now builds explicitly ahead of the loop, mirroring
the agent-base special case) — a fresh registry pull could never
succeed. Both compose files gain a backup sidecar on the data network:
pg_dump -Fc on start and every 24h, crash-safe tmp+rename, newest-14
rotation, restore walkthrough in docs/backend/ops/database-backups.md.

* chore(docs): reflow hard-wrapped prose inherited from the six-PR merge train

* chore(foundation): regenerate lifecycle artifacts; reflow inherited prose

---------

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

docker-compose.yml

@@ -47,6 +47,31 @@ services:
       timeout: 5s
       retries: 5
 
+  # ==========================================================================
+  # Backup - periodic pg_dump of the roboco DB (interim; no PITR/WAL yet)
+  # ==========================================================================
+  backup:
+    image: pgvector/pgvector:pg16
+    container_name: roboco-backup
+    restart: unless-stopped
+    # data-only network — pg_dump reaches postgres by container name, same
+    # as every other data-network consumer; never exposed to the agent mesh.
+    networks:
+      - data
+    environment:
+      POSTGRES_HOST: roboco-postgres
+      POSTGRES_PORT: 5432
+      POSTGRES_USER: roboco
+      POSTGRES_PASSWORD: roboco
+      POSTGRES_DB: roboco
+    entrypoint: ["/bin/bash", "/scripts/backup-entrypoint.sh"]
+    volumes:
+      - ./docker/scripts/backup-entrypoint.sh:/scripts/backup-entrypoint.sh:ro
+      - ${ROBOCO_DATA_DIR:-./data}/backups:/backups
+    depends_on:
+      postgres:
+        condition: service_healthy
+
   # ==========================================================================
   # MinIO - Object storage for rendered videos (NAS default-on; registry OFF)
   # ==========================================================================