feat(v0.8.9): address all issues labeled v0.8.9

#551 — sidebar filters prior-session agents (from_prior_session)
#552 — status messages prioritise ↑ affordance over /queue
#553 — oversized paste consolidation to @mention file (+uuid suffix)
#523 — release.yml: add if: guard so release job doesn't skip on dispatch
#526 — verify cost_status side-channel is fully wired (already in place)
#554 — mouse/trackpad scroll now sets user_scrolled_during_stream
#522 — set RELEASE_TAG_PAT secret for auto-tag → release trigger
#504 — session-context panel (SidebarFocus::Context, config toggle, default off)
#501 — multi-arch Dockerfile (+BUILDPLATFORM pin) + devcontainer + release CI
#484 — docs/RUNTIME_API.md rewritten against actual runtime_api.rs endpoints
#482 — close v0.8.8 planning tracker

Fixes from review:
- RUNTIME_API.md: corrected endpoints (/v1/...), port (7878), doctor JSON schema (flat)
- Dockerfile: added --platform=$BUILDPLATFORM for native multi-arch builds
- docs/DOCKER.md: removed Docker Hub references (GHCR only)
- sidebar.rs: dropped unused _theme variable
- settings.rs: context_panel default changed to false
- app.rs: paste filename now includes 8-char uuid suffix to avoid collision

Dockerfile

@@ -0,0 +1,68 @@
+# syntax=docker/dockerfile:1
+# DeepSeek-TUI multi-arch Docker image (#501)
+#
+# Build:  docker buildx build --platform linux/amd64,linux/arm64 -t deepseek-tui:latest .
+# Run:    docker run --rm -it -e DEEPSEEK_API_KEY -v ~/.deepseek:/home/deepseek/.deepseek deepseek-tui
+#
+# The image ships both binaries (deepseek dispatcher + deepseek-tui runtime)
+# in a minimal runtime layer. No MCP servers or heavy toolchains are included
+# — keep it slim.
+
+ARG RUST_VERSION=1.85
+
+# ── Stage 1: Build ────────────────────────────────────────────────────
+FROM --platform=$BUILDPLATFORM rust:${RUST_VERSION}-slim-bookworm AS builder
+ARG TARGETPLATFORM
+ARG BUILDPLATFORM
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    pkg-config libdbus-1-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+# Translate Docker platform into Rust target triple.
+# linux/amd64  → x86_64-unknown-linux-gnu
+# linux/arm64  → aarch64-unknown-linux-gnu
+RUN case "${TARGETPLATFORM}" in \
+      linux/amd64)  echo x86_64-unknown-linux-gnu  > /rust-target ;; \
+      linux/arm64)  echo aarch64-unknown-linux-gnu > /rust-target ;; \
+      *)            echo "Unsupported platform: ${TARGETPLATFORM}" >&2; exit 1 ;; \
+    esac
+
+RUN rustup target add "$(cat /rust-target)"
+
+WORKDIR /build
+COPY . .
+
+# Build both binaries for the target platform.  --locked ensures
+# reproducible builds from the committed lockfile.
+RUN --mount=type=cache,target=/build/target \
+    --mount=type=cache,target=/usr/local/cargo/registry \
+    cargo build --release --locked --target "$(cat /rust-target)" \
+    && mkdir -p /out \
+    && cp target/$(cat /rust-target)/release/deepseek /out/ \
+    && cp target/$(cat /rust-target)/release/deepseek-tui /out/
+
+# ── Stage 2: Runtime ──────────────────────────────────────────────────
+FROM debian:bookworm-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    libdbus-1-3 \
+    && rm -rf /var/lib/apt/lists/*
+
+# Non-root user.
+RUN useradd --create-home --shell /bin/bash deepseek
+USER deepseek
+WORKDIR /home/deepseek
+
+COPY --from=builder --chown=deepseek:deepseek /out/deepseek /usr/local/bin/deepseek
+COPY --from=builder --chown=deepseek:deepseek /out/deepseek-tui /usr/local/bin/deepseek-tui
+
+# The dispatcher expects to find its companion binary next to it.
+# Both are in /usr/local/bin — no further path setup needed.
+
+ENV DEEPSEEK_API_KEY=""
+ENV DEEPSEEK_NO_COLOR=""
+
+ENTRYPOINT ["deepseek"]
+CMD []