Bake identity into the image; volume holds only runtime state

Identity (CLAUDE.md, GOALS.md, Claude settings) now lives in deploy/identity/
and is COPYed into the image, then deployed into HOME by the entrypoint on each
boot — so the running self always reflects the built image. Rebuilding is what
promotes an identity change (a push alone does not). quince-home is now purely
the runtime volume (.ssh, notes, workspace, logs, .claude memory, gutasktool).

Updated CLAUDE.md self-update loop, README (architecture + redeploy steps), and
.gitignore accordingly.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deploy/Dockerfile

@@ -25,6 +25,13 @@ COPY entrypoint.sh /usr/local/bin/entrypoint.sh
 COPY wake.sh        /usr/local/bin/wake.sh
 RUN chmod +x /usr/local/bin/entrypoint.sh /usr/local/bin/wake.sh
 
+# Baked identity. This is the canonical Quince — CLAUDE.md, GOALS.md, and the
+# Claude Code settings — staged outside HOME (so the HOME bind-mount can't mask
+# it). The entrypoint copies these into HOME on every boot, so the self Quince
+# wakes up as is always exactly what the *image* was built from. Change the self
+# by editing deploy/identity/ in the repo and rebuilding.
+COPY identity/ /opt/quince/identity/
+
 USER quince
 ENV HOME=/home/quince
 # ~/.local/bin holds the `gutask` console script after pip install --user -e.