fix(gitea-actions): serve CI images from the Gitea registry

The CI job images only existed under localhost/ in the gitea-runner store,
and the nightly CI prune deletes any image older than 48h that no container
holds. After every idle stretch CI failed in 0-1s pulling
localhost/gitea-ci:latest until the role was re-run and the images rebuilt.

- Build under git.debyl.io/gitbot/..., push after every run, and pull from the
  registry instead of rebuilding when the Containerfile is unchanged.
- Log gitea-runner in via ~/.docker/config.json, which both act_runner (job
  image pulls) and podman read.
- Label the base images io.debyl.ci-base and skip that label in the CI prune;
  its `until` counts from build time, so a re-pulled image would otherwise be
  deleted again the next night.

Workflows pinning `container: image: localhost/gitea-ci-*` must move to the
registry paths.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

ansible/roles/podman/defaults/main.yml

@@ -311,6 +311,9 @@ podman_prune_ci_users:
   - gitea-runner
   - actions-runner
 podman_prune_ci_until: 48h
+# CI base images built by roles/gitea-actions carry this label (gitea_ci_keep_label
+# there -- keep the two in sync) and are skipped by the CI image prune.
+podman_prune_ci_keep_label: io.debyl.ci-base
 
 # Daily rather than weekly: CI turns over many images a day, and a week of that
 # is what let the store reach 113 GB between runs.

ansible/roles/podman/templates/podman-prune.sh.j2

@@ -43,9 +43,10 @@ run() {
      exec podman "$@"' _ "$@"
 }
 
-# prune_user <user> <until> <prune_containers: yes|no>
+# prune_user <user> <until> <prune_containers: yes|no> [image prune filter...]
 prune_user() {
   local u=$1 keep=$2 do_containers=$3
+  shift 3
   local before after img vol con
 
   if ! id "$u" >/dev/null 2>&1; then
@@ -66,7 +67,7 @@ prune_user() {
     con=$(run "$u" container prune -f --filter "until=$keep" 2>&1 | tail -1)
   fi
 
-  img=$(run "$u" image prune -af --filter "until=$keep" 2>&1 | tail -1)
+  img=$(run "$u" image prune -af --filter "until=$keep" "$@" 2>&1 | tail -1)
   vol=$(run "$u" volume prune -f 2>&1 | tail -1)
 
   after=$(run "$u" system df --format '{{ '{{' }}.Size{{ '}}' }}' 2>/dev/null | head -1)
@@ -80,7 +81,10 @@ for u in {{ podman_prune_users | join(' ') }}; do
 done
 
 for u in {{ podman_prune_ci_users | join(' ') }}; do
-  prune_user "$u" "{{ podman_prune_ci_until }}" yes
+  # CI base images (gitea-ci, -espidf, -platformio) carry the keep label: they
+  # are rebuilt or re-pulled from the registry only when missing, so pruning
+  # them just forces a multi-GB re-download on the next job.
+  prune_user "$u" "{{ podman_prune_ci_until }}" yes --filter "label!={{ podman_prune_ci_keep_label }}"
 done
 
 log "status=ok"