feat(09-05): build + push botfights:1.2.0 to the vps2 registry

- Fixed a pre-existing pnpm overrides config drift (package.json's dead
  pnpm.overrides key vs pnpm-workspace.yaml's overrides, never fully
  migrated after commit bcb323e) that was blocking the docker build's
  `pnpm install --frozen-lockfile` step under a current pnpm version.
  Zero dependency specifier changes in the regenerated lockfile.
- Built and pushed 146.59.87.168:3000/lfg2025/botfights:1.2.0 from
  botfight main @ 2a343ac (arena-proxy + nostr-only auth + unified
  prompt, all three wave-1 plans confirmed present before build).
- Documented the build/push recipe, the gotcha, and the smoke test in
  docs/arena-deployment.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/arena-deployment.md

@@ -178,6 +178,72 @@ curl -fsS --max-time 10 http://146.59.87.168:9100/api/health
 curl -fsS --max-time 10 http://146.59.87.168:9100/api/bots   # expect 100 (+15 classic)
 ```
 
+## Building and pushing `botfights:1.2.0` (plan 09-05)
+
+`1.2.0` is the first image built after the arena-proxy middleware (09-01),
+the nostr-only `GET /api/auth/me` auth fix (09-02), and the unified
+`GET /api/docs/prompt` AI setup prompt (09-03) all landed on `main`. Build
+from a clean checkout of `origin/main`:
+
+```bash
+cd /home/archipelago/Projects/botfight
+git pull --ff-only origin main
+# confirm all three wave-1 plans are present before building:
+test -f server/src/middleware/arena-proxy.ts
+grep -q "get('/me'" server/src/routes/auth.ts
+grep -q "get('/prompt'" server/src/routes/docs.ts
+
+podman build --build-arg CACHE_BUST=$(date +%s) \
+  -t 146.59.87.168:3000/lfg2025/botfights:1.2.0 .
+
+# Smoke test locally BEFORE pushing (spare port, no upstream configured):
+podman run --rm -d --name botfights-smoketest -p 9199:9100 \
+  -e NODE_ENV=production -e JWT_SECRET=$(openssl rand -hex 32) \
+  146.59.87.168:3000/lfg2025/botfights:1.2.0
+curl -fsS http://127.0.0.1:9199/api/health
+curl -fsSi http://127.0.0.1:9199/api/docs/prompt | head -3   # expect 200, text/markdown
+curl -si http://127.0.0.1:9199/api/auth/me | head -3         # expect 401, no Authorization header
+podman rm -f botfights-smoketest
+
+# Push (registry is plain HTTP; 146.59.87.168:3000 is already configured as an
+# insecure registry in /etc/containers/registries.conf.d/archipelago.conf on
+# this host, but --tls-verify=false is passed explicitly too):
+podman login 146.59.87.168:3000 -u lfg2025 -p <token from Gitea admin, see infra memory note>
+podman push --tls-verify=false 146.59.87.168:3000/lfg2025/botfights:1.2.0
+
+# Verify from the registry side:
+skopeo inspect --tls-verify=false docker://146.59.87.168:3000/lfg2025/botfights:1.2.0
+```
+
+**Build gotcha hit this session (pre-existing, unrelated to phase 09's own
+code — fixed as an in-scope blocking-issue deviation):** `pnpm install
+--frozen-lockfile` inside the `deps` build stage failed with
+`ERR_PNPM_LOCKFILE_CONFIG_MISMATCH`. Root cause: an earlier commit
+(`bcb323e`, March 2026) moved dependency `overrides` from `package.json`'s
+`pnpm.overrides` key (a location modern pnpm no longer reads at all — see
+its own deprecation warning) to `pnpm-workspace.yaml`'s `overrides:` key,
+but only migrated 2 of 3 override entries and never regenerated
+`pnpm-lock.yaml` to match. The Dockerfile's `corepack prepare pnpm@latest`
+pulls whatever pnpm is current at build time, which enforces the
+lockfile-vs-config check strictly. Fixed by: removing the dead `pnpm`
+field from `package.json`, adding the missing `tar: '>=7.5.11'` override to
+`pnpm-workspace.yaml` (alongside the two already there), and regenerating
+`pnpm-lock.yaml` with `pnpm install --no-frozen-lockfile` — the resulting
+lockfile diff contains **zero** `specifier:` changes (verified by grep),
+only peer-dependency resolution-graph annotations from the newer pnpm
+version explicitly listing `supports-color` as a peer. `pnpm install
+--frozen-lockfile` and `tsc --noEmit -p server/tsconfig.json` both pass
+clean against the regenerated lockfile.
+
+**Result (this session, 2026-07-31):**
+
+| Field | Value |
+|---|---|
+| Tag | `146.59.87.168:3000/lfg2025/botfights:1.2.0` |
+| Digest | `sha256:5470019a...c1b6` (short form; full digest recorded in `.planning/phases/09-botfights-platform-upgrade/09-05-SUMMARY.md` — re-derive any time with `skopeo inspect` above) |
+| Built from | `botfight` repo `main` @ `2a343ac` (HEAD at build time, matches `origin/main`) |
+| Local smoke test | `/api/health` → `{"status":"ok",...}`; `/api/docs/prompt` → 200 `text/markdown`; `/api/auth/me` (no auth) → 401 |
+
 ## Rolling the image tag
 
 The tag is kept in exactly one place — `docker-compose.arena.yml`'s

package.json

@@ -13,12 +13,6 @@
     "seed": "pnpm --filter server seed",
     "test:e2e": "playwright test --config e2e/playwright.config.ts"
   },
-  "pnpm": {
-    "overrides": {
-      "tar": ">=7.5.11",
-      "serialize-javascript": ">=7.0.3"
-    }
-  },
   "devDependencies": {
     "@playwright/test": "1.58.2",
     "@typescript-eslint/eslint-plugin": "8.56.1",

pnpm-workspace.yaml

@@ -9,3 +9,4 @@ onlyBuiltDependencies:
 overrides:
   esbuild@<=0.24.2: '>=0.25.0'
   serialize-javascript@<=7.0.2: '>=7.0.3'
+  tar: '>=7.5.11'