chore: initialise Noema repository

Foundation for the persistent, inspectable cognitive runtime: README,
implementation plan with phases and risk register, architecture,
security model, threat model, contributing guide, eight ADRs covering
the global workspace, event immutability, memory representation, LLM
abstraction, capability system, authentication, frontend and storage.
Includes Makefile, env example, compose stack (pgvector) and Dockerfile
skeleton, plus a record of the development environment assumptions.

deploy/Dockerfile

@@ -0,0 +1,18 @@
+# syntax=docker/dockerfile:1
+FROM golang:1.26-alpine AS build
+WORKDIR /src
+RUN apk add --no-cache git
+COPY go.mod go.sum* ./
+RUN --mount=type=cache,target=/go/pkg/mod go mod download
+COPY . .
+ARG VERSION=dev
+RUN --mount=type=cache,target=/go/pkg/mod --mount=type=cache,target=/root/.cache/go-build \
+    CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X github.com/andydixon/noema/internal/version.Version=${VERSION}" -o /out/ ./cmd/...
+
+FROM alpine:3.20
+RUN apk add --no-cache ca-certificates git tzdata && adduser -D -u 10001 noema
+COPY --from=build /out/noemad /out/noemactl /usr/local/bin/
+USER noema
+ENV NOEMA_HTTP_ADDR=0.0.0.0:8080 NOEMA_RESEARCH_DIR=/research
+EXPOSE 8080
+ENTRYPOINT ["noemad"]

deploy/docker-compose.yml

@@ -0,0 +1,40 @@
+# Development stack: PostgreSQL with pgvector, and Noema.
+# `make dev-db` starts only the database; `docker compose -f deploy/docker-compose.yml up` starts both.
+services:
+  db:
+    image: pgvector/pgvector:pg16
+    environment:
+      POSTGRES_USER: noema
+      POSTGRES_PASSWORD: noema      # development only; override in production
+      POSTGRES_DB: noema
+    ports:
+      - "127.0.0.1:5433:5432"
+    volumes:
+      - noema-pgdata:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U noema"]
+      interval: 5s
+      timeout: 3s
+      retries: 20
+
+  noema:
+    build:
+      context: ..
+      dockerfile: deploy/Dockerfile
+    depends_on:
+      db:
+        condition: service_healthy
+    env_file:
+      - ../.env
+    environment:
+      NOEMA_HTTP_ADDR: 0.0.0.0:8080
+      NOEMA_DATABASE_URL: postgres://noema:noema@db:5432/noema?sslmode=disable
+    ports:
+      - "127.0.0.1:8080:8080"
+    volumes:
+      - noema-research:/research
+    profiles: ["app"]
+
+volumes:
+  noema-pgdata:
+  noema-research: