feat: prepare deep search production runtime

docs/deep-search-service.md

@@ -30,6 +30,11 @@ npm run dev:deep-search
 
 The server listens on `127.0.0.1:20100` by default.
 
+On production host `103`, SearXNG is exposed at
+`http://127.0.0.1:20080/search`. Goosed containers reach host services through
+`host.docker.internal`; Portal rewrites loopback MindSearch service endpoints
+only when constructing the MCP extension environment.
+
 ## API
 
 | Method | Path | Purpose |
@@ -73,6 +78,7 @@ Start response:
 | `TKMIND_DEEP_SEARCH_SECRET` | empty | Optional `X-Secret-Key` required by non-health routes |
 | `TKMIND_DEEP_SEARCH_LLM_GATEWAY_URL` | `http://127.0.0.1:8081/api/internal/deep-search/llm` | Portal LLM gateway |
 | `TKMIND_DEEP_SEARCH_LLM_GATEWAY_SECRET` | `TKMIND_DEEP_SEARCH_SECRET` | Portal gateway bearer secret |
+| `GITHUB_TOKEN` | empty | GitHub code-search token, stored only in the standalone service environment |
 
 ## Isolation and safety
 
@@ -84,6 +90,40 @@ Start response:
 - Source reading rejects credentials, loopback, link-local, private, multicast, and private-DNS destinations.
 - Redirect targets are resolved and validated again.
 - Request bodies, result counts, source content, timeouts, and task depths are bounded.
+- GitHub Code Search is proxied by Deep Search so the provider token is never
+  copied into goosed extension environments.
+
+## Production runtime on 103
+
+Deep Search is released independently from Portal and `memindadm`:
+
+```bash
+npm run build:deep-search-runtime
+CONFIRMED_CI_SHA="$(git rev-parse HEAD)" \
+  bash scripts/release-deep-search-runtime-prod.sh
+```
+
+The production layout is:
+
+```text
+/Users/john/Project/deep-search-runtime/
+├── current -> releases/<release-id>/
+├── releases/<release-id>/
+├── shared/.env
+├── data/research.sqlite
+├── logs/deep-search.log
+└── backups/<release-id>/
+```
+
+The release workflow requires a clean `main` that exactly matches
+`origin/main`, a matching confirmed CI SHA, artifact checksum verification,
+SQLite online backup, LaunchAgent rollback, host health/search probes, and a
+Goose-container reachability probe. It never releases or restarts Portal or
+`memindadm`.
+
+The installer creates a random service secret on first install. Add a newly
+issued, least-privilege GitHub token to `shared/.env` only after revoking any
+token that has appeared in chat or logs.
 
 ## MindSearch registration