deploy: static binary and a compose project name that does not collide

Two failures from the first real deploy, both repo-side:

1. The container logged "exec /usr/bin/resume-server: no such file or
   directory" and restarted until the health gate failed. The build host has
   cgo enabled, so the binary carried the nix glibc interpreter, and the
   distroless/static image has no dynamic loader. Every SQLite path already
   uses pure-Go modernc.org/sqlite, so build with CGO_ENABLED=0 and ship a
   static binary.

2. Compose warned about orphan containers ai-resume-backend-1 and
   ai-resume-db-1: /home/sam/deployment/ai-resume on .13 already owns the
   `ai-resume` compose project (on the ai-mesh network). Sharing the name makes
   each stack visible as orphans to the other, so a `compose down
   --remove-orphans` in either could stop the other. Run the site as project
   `ai-resume-site`; the image tag stays ai-resume:local and the port binding,
   mem_limit and memswap_limit are untouched.

deploy/deploy.sh

@@ -38,7 +38,9 @@
 
 set -Eeuo pipefail
 
-APP=ai-resume
+APP=ai-resume                  # image tag (fixed by Phase 3 §3.2)
+PROJECT=ai-resume-site         # compose project; distinct from the older
+                               # /home/sam/deployment/ai-resume project on .13
 PORT=8096
 HEALTH_PATH=/healthz
 
@@ -92,7 +94,7 @@ done
 
 # ---------------------------------------------------------------- helpers ---
 
-compose() { docker compose -f "$COMPOSE" -p "$APP" "$@"; }
+compose() { docker compose -f "$COMPOSE" -p "$PROJECT" "$@"; }
 
 current_target()  { readlink -- "$CURRENT" 2>/dev/null || true; }
 previous_target() { readlink -- "$PREVIOUS" 2>/dev/null || true; }