Say how to run the journey, where to get the image, and what nothing sweeps

[davidmckayv]

Documentation only. Three things it asked for that could not be done from what it said.

The smoke journey needs a session. Every route it proves is behind requireUser, and the
file sent no credentials, so three of its five tests answered 401 on any deployment with an
identity provider, which is every deployment this repository will start. development.md and
releasing.md now say so, and say where the cookie comes from; the generated release PR
checklist asks for the journey with OPENBOT_SMOKE_COOKIE set, rather than asking for a result
nobody could produce.

Deploying said to build the image. A release has published one since v0.0.8, so the first
command is now docker run ghcr.io/copilotkit/openbot:latest in both README.md and
deployment.md, with the build kept for anybody deploying a tree of their own, and the
digest-pinning advice pointed at.

Nothing outside Kubernetes sweeps staged attachments. The chart runs it hourly;
docker-compose.yml and scripts/start.sh do not run it at all. On a laptop that is nothing
until the thirty-second unsent file, where the refusal a person sees promises a clearing that
nothing performs. development.md says it beside the ports, where somebody running the stack
will meet it.

Checked against the tree rather than against the older documentation:

• the app is served by the API on the same origin inside the image (APP_DIST_DIR, PORT=3001
  in the Dockerfile), so the image really is one port and the app is not on 3010 there
• the sweep defaults to 24 hours and takes fractional hours as its one positional argument
• the per-person ceiling on unsent files is four messages' worth, and removing a file in the
  composer deletes the row, so it takes abandoned drafts to reach
• every variable these documents name exists in the code, and every key .env.example ships is
  documented somewhere