fix(gitea-actions): serve CI images from the Gitea registry

The CI job images only existed under localhost/ in the gitea-runner store,
and the nightly CI prune deletes any image older than 48h that no container
holds. After every idle stretch CI failed in 0-1s pulling
localhost/gitea-ci:latest until the role was re-run and the images rebuilt.

- Build under git.debyl.io/gitbot/..., push after every run, and pull from the
  registry instead of rebuilding when the Containerfile is unchanged.
- Log gitea-runner in via ~/.docker/config.json, which both act_runner (job
  image pulls) and podman read.
- Label the base images io.debyl.ci-base and skip that label in the CI prune;
  its `until` counts from build time, so a re-pulled image would otherwise be
  deleted again the next night.

Workflows pinning `container: image: localhost/gitea-ci-*` must move to the
registry paths.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

ansible/roles/gitea-actions/defaults/main.yml

@@ -22,18 +22,57 @@ act_runner_bin: /usr/local/bin/act_runner
 act_runner_config_dir: /etc/act_runner
 act_runner_work_dir: /var/lib/act_runner
 
-# Job container images (built locally into the gitea-runner rootless image
-# store by tasks/images.yml; never pulled — force_pull is false).
-gitea_ci_image: localhost/gitea-ci:latest
+# Job container images. tasks/images.yml builds them into the gitea-runner
+# rootless store and pushes them to the Gitea container registry.
+#
+# They used to live only under localhost/, and the nightly podman prune
+# (roles/podman: podman_prune_ci_until) deletes any CI-user image older than
+# 48h that no container is using -- so every idle weekend CI failed in 0-1s on
+# `docker pull localhost/gitea-ci:latest` until someone re-ran this role and
+# waited out a full rebuild. With a registry copy, a pruned image is simply
+# re-pulled by the next job (force_pull stays false, so a present image is
+# never re-pulled), and this role pulls instead of rebuilding when the
+# Containerfile has not changed.
+#
+# Workflows that pin `container: image:` must use these registry paths too
+# (esp-mg-tpms, skudak/esp32-stm32-vcu, skudak/esp32-web-interface).
+gitea_ci_registry: git.debyl.io
+# Namespace = the owner of gitea_registry_username / gitea_registry_token (vault).
+gitea_ci_registry_namespace: gitbot
+gitea_ci_image: "{{ gitea_ci_registry }}/{{ gitea_ci_registry_namespace }}/gitea-ci:latest"
 # ESP-IDF firmware image tag tracks the upstream espressif/idf release we build from.
 esp_idf_version: v5.4.1
-gitea_ci_espidf_image: "localhost/gitea-ci-espidf:{{ esp_idf_version }}"
+gitea_ci_espidf_image: "{{ gitea_ci_registry }}/{{ gitea_ci_registry_namespace }}/gitea-ci-espidf:{{ esp_idf_version }}"
 # PlatformIO image for Arduino-framework ESP32 builds (esp32-web-interface).
 # Tag tracks the pre-baked espressif32 platform version; both pins match the
 # hardware-validated local build.
 platformio_core_version: "6.1.19"
 pio_espressif32_version: "7.0.1"
-gitea_ci_platformio_image: "localhost/gitea-ci-platformio:{{ pio_espressif32_version }}"
+gitea_ci_platformio_image: "{{ gitea_ci_registry }}/{{ gitea_ci_registry_namespace }}/gitea-ci-platformio:{{ pio_espressif32_version }}"
+
+# Registry credentials for the gitea-runner user. The Docker-format path is read
+# by both act_runner (to authenticate job image pulls) and podman (as its
+# fallback auth file), so one login covers the runner and this role.
+gitea_ci_registry_authfile: "{{ gitea_runner_home }}/.docker/config.json"
+
+# Label stamped on the CI base images so the nightly prune skips them; must match
+# podman_prune_ci_keep_label in roles/podman/defaults/main.yml. Without it the
+# prune (whose `until` counts from build time, not pull time) would delete a
+# re-pulled image again the next night -- a 7.8 GB ESP-IDF re-download after
+# every idle day. Superseded tags (e.g. after an esp_idf_version bump) are
+# therefore kept too; remove them by hand.
+gitea_ci_keep_label: io.debyl.ci-base
+
+gitea_ci_images:
+  - image: "{{ gitea_ci_image }}"
+    containerfile: Containerfile.ci
+    template: Containerfile.ci
+  - image: "{{ gitea_ci_espidf_image }}"
+    containerfile: Containerfile.espidf
+    template: Containerfile.espidf.j2
+  - image: "{{ gitea_ci_platformio_image }}"
+    containerfile: Containerfile.platformio
+    template: Containerfile.platformio.j2
 
 # Default labels for every runner — map runs-on values to the local CI image.
 # Firmware jobs opt into the ESP-IDF image per-job via `container:` in their workflow.