Lab10 submission

[tdzdslippen]

Goal

Lab 10 — tag-triggered CI push of QuickNotes to GHCR, deploy the same image on Hugging Face Spaces, and document warm latency (bonus Cloudflare Tunnel deferred).

Changes

• .github/workflows/release.yml — release on v* tags (semver check), builds app/ for linux/amd64, pushes to ghcr.io/tdzdslippen/devops-intro/quicknotes with v0.1.0 + latest; contents: read, packages: write; third-party actions SHA-pinned.
• cloud/huggingface/Dockerfile + README.md — HF Space pulls immutable v0.1.0 from GHCR; README frontmatter sets sdk: docker, app_port: 8080.
• cloud/teardown.md — cleanup notes for Space / GHCR / tunnel.
• cloud/cloudflare/README.md + artifacts/lab10/cloudflare/BONUS_PENDING.md — bonus not claimed yet.
• artifacts/lab10/ — registry evidence (release run, unauthenticated pulls, digest) + HF curl proof and warm latency logs.
• submissions/lab10.md — Tasks 1–2 write-up, design answers a–f, warm/cold latency table.
• Carries forward Lab 6 image (app/Dockerfile, compose.yaml) and Lab 9 CI/security headers (.github/workflows/ci.yml, app/security.go).

Testing

• Task 1: signed tag v0.1.0 → green Release run: https://github.com/tdzdslippen/DevOps-Intro/actions/runs/28686721652
  Image: ghcr.io/tdzdslippen/devops-intro/quicknotes:v0.1.0 (digest sha256:9aa52b11a32c2bfbcb40c4b862d5f8762e80acb6efa67b55655033069543b86d); package public; unauthenticated docker pull for v0.1.0 and latest both succeed with the same digest.
• Task 2: HF Space https://huggingface.co/spaces/laptevarseniy/quicknotes-lab10 — public URL https://laptevarseniy-quicknotes-lab10.hf.space returns /health → {"notes":4,"status":"ok"} and /notes lists seeded notes; warm p50 0.479974 s (5 consecutive curls). Cold latency samples recorded in submission/artifacts.
• Design questions a–f answered in submissions/lab10.md.
• Bonus: Cloudflare Tunnel not included (pending).

Checklist

• Title is a clear sentence (≤ 70 chars)
• Commits are signed (git log --show-signature)
• submissions/lab10.md updated