ci: release mai-bot without external image pulls

deploy/server-maibot/README_DEPLOY_STEPS.txt

@@ -3,6 +3,7 @@ Release archive directory: /srv/maibot/releases
 
 Repo-managed deployment files:
 - deploy/server-maibot/Dockerfile.offline
+- deploy/server-maibot/Dockerfile.release
 - deploy/server-maibot/docker-entrypoint.offline.sh
 - deploy/server-maibot/docker-compose.server.yml
 - deploy/server-maibot/activate-release.sh
@@ -23,10 +24,18 @@ Current pipeline mode:
 - single-host release on the repo-level `build-host` runner
 - clones from local Gitea HTTP on `127.0.0.1:3000`
 - stages source into `/srv/maibot/releases/<commit>`
-- activates it into `/root/maibot-offline`
+- builds `maibot-offline:<commit>` from the staged release using local base image `maibot-offline:latest`
+- tags the same image back to `maibot-offline:latest`
+- deploys from `/root/maibot-offline` with `docker compose up -d`
 
 Optional environment overrides for the workflow runtime:
 - `MAIBOT_RELEASE_ROOT`
 - `MAIBOT_RUNTIME_ROOT`
+- `MAIBOT_BASE_IMAGE`
 
 No repository secrets are required for the default same-host pipeline.
+
+Bootstrap note:
+- `deploy/server-maibot/Dockerfile.offline` is only for the first bootstrap or for refreshing the runtime base image.
+- The normal Gitea release pipeline uses `deploy/server-maibot/Dockerfile.release`, so it does not need Docker Hub or GitHub during each deploy.
+- If `pyproject.toml` or `uv.lock` changes, refresh the local base image once before relying on the release pipeline again.