fix(gitea-actions): serve CI images from the Gitea registry

The CI job images only existed under localhost/ in the gitea-runner store,
and the nightly CI prune deletes any image older than 48h that no container
holds. After every idle stretch CI failed in 0-1s pulling
localhost/gitea-ci:latest until the role was re-run and the images rebuilt.

- Build under git.debyl.io/gitbot/..., push after every run, and pull from the
  registry instead of rebuilding when the Containerfile is unchanged.
- Log gitea-runner in via ~/.docker/config.json, which both act_runner (job
  image pulls) and podman read.
- Label the base images io.debyl.ci-base and skip that label in the CI prune;
  its `until` counts from build time, so a re-pulled image would otherwise be
  deleted again the next night.

Workflows pinning `container: image: localhost/gitea-ci-*` must move to the
registry paths.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

ansible/roles/podman/defaults/main.yml

@@ -311,6 +311,9 @@ podman_prune_ci_users:
   - gitea-runner
   - actions-runner
 podman_prune_ci_until: 48h
+# CI base images built by roles/gitea-actions carry this label (gitea_ci_keep_label
+# there -- keep the two in sync) and are skipped by the CI image prune.
+podman_prune_ci_keep_label: io.debyl.ci-base
 
 # Daily rather than weekly: CI turns over many images a day, and a week of that
 # is what let the store reach 113 GB between runs.