Add local Docker registry: registry:2 on :5000, build-push.sh, CI auto-deploy

- docker-compose services now pull from localhost:5000 instead of building locally
- build-push.sh builds + pushes all 5 Node images to local registry
- CI workflows get build-push job: test → build → push → deploy
- Deploy becomes: docker compose pull && docker compose up -d
- Eliminates silent git pull + stale Docker cache issues

products/build-push.sh

@@ -0,0 +1,75 @@
+#!/bin/bash
+
+# dd0c CI Build & Push to Local Registry
+# Builds Docker images for all Node services and pushes to localhost:5000
+#
+# Usage:
+#   ./build-push.sh              # Build all services
+#   ./build-push.sh drift alert  # Build specific services
+
+set -euo pipefail
+
+REGISTRY="${REGISTRY:-localhost:5000}"
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+declare -A CONTEXTS=(
+  ["dd0c-drift"]="02-iac-drift-detection/saas"
+  ["dd0c-alert"]="03-alert-intelligence"
+  ["dd0c-portal"]="04-lightweight-idp"
+  ["dd0c-cost"]="05-aws-cost-anomaly"
+  ["dd0c-run"]="06-runbook-automation/saas"
+)
+
+# If args provided, filter to those services
+if [ $# -gt 0 ]; then
+  TARGETS=()
+  for arg in "$@"; do
+    key="dd0c-${arg}"
+    if [ -n "${CONTEXTS[$key]+x}" ]; then
+      TARGETS+=("$key")
+    else
+      echo -e "${RED}Unknown service: $arg${NC}" >&2
+      echo "Available: drift alert portal cost run" >&2
+      exit 1
+    fi
+  done
+else
+  TARGETS=("dd0c-drift" "dd0c-alert" "dd0c-portal" "dd0c-cost" "dd0c-run")
+fi
+
+echo -e "${YELLOW}dd0c Build & Push — $(date -u '+%Y-%m-%d %H:%M UTC')${NC}"
+echo -e "Registry: ${REGISTRY}\n"
+
+FAILED=0
+for img in "${TARGETS[@]}"; do
+  ctx="${CONTEXTS[$img]}"
+  tag="${REGISTRY}/${img}:latest"
+
+  echo -e "${YELLOW}▸ Building ${img}${NC}"
+  if docker build -t "$tag" "$SCRIPT_DIR/$ctx" --no-cache; then
+    echo -e "${YELLOW}  Pushing ${tag}${NC}"
+    if docker push "$tag"; then
+      echo -e "  ${GREEN}✓${NC} ${img}"
+    else
+      echo -e "  ${RED}✗${NC} Push failed: ${img}"
+      ((FAILED++)) || true
+    fi
+  else
+    echo -e "  ${RED}✗${NC} Build failed: ${img}"
+    ((FAILED++)) || true
+  fi
+  echo ""
+done
+
+if [ "$FAILED" -eq 0 ]; then
+  echo -e "${GREEN}All images built and pushed.${NC}"
+  echo -e "Deploy: ${YELLOW}docker compose pull && docker compose up -d${NC}"
+else
+  echo -e "${RED}${FAILED} service(s) failed.${NC}"
+  exit 1
+fi