recipe-maintainer: public snapshot (secrets + deployment plans removed, single commit)

Sanitized single-commit public mirror of recipe-maintainer.
- Removed test-ssh/.testenv (live creds); added test-ssh/.testenv.example placeholders.
- Removed plans/ and planned-updates/ (deployment-planning docs) so no client/
  deployment domains appear in the public repo.
- All other secret stores were already gitignored.
- docs.coopcloud.tech retained as a submodule (public upstream).

sandbox/docker-compose.yml

@@ -0,0 +1,22 @@
+services:
+  claude:
+    image: sandbox
+    env_file:
+      - path: ./.env
+        required: false
+    environment:
+      HOST_UID: "${HOST_UID:-0}"
+      HOST_GID: "${HOST_GID:-0}"
+    volumes:
+      - .:/workspace                          # default; overridden by claude.py at runtime
+      - claude_target:/workspace/target       # persist Rust build cache
+      - claude_userhome:/home/claude          # persist Claude settings, auth, history
+      - ./.container-abra:/home/claude/.abra  # default; overridden by claude.py at runtime
+      - tailscale_state:/var/lib/tailscale    # persist Tailscale auth across restarts
+    tty: true
+    stdin_open: true
+
+volumes:
+  claude_target:
+  claude_userhome:
+  tailscale_state: