feat(gitea-actions): build the CI job images in Gitea CI

The runner's job images were built by ansible into localhost/ only, so the
nightly CI prune deleted them and every idle stretch ended with CI failing in
under a second on `docker pull localhost/gitea-ci:latest` until someone re-ran
the role and waited out a rebuild. The previous commit moved them to the Gitea
registry; this moves the *build* off the deploy path entirely.

- .gitea/workflows/ci-images.yml builds files/Containerfile.* and pushes to
  git.debyl.io/gitbot/. Per-image change detection, so an ESP-IDF pin bump does
  not rebuild the other two; weekly schedule for base-image updates; a
  workflow_dispatch selector. PRs build under a throwaway :pr-<n> tag and drop
  it -- the build lands in the live runner's store, and act_runner will not
  re-pull a tag it already has, so a PR using the real tag would hand every
  later job on this host an unmerged image.
- The Containerfiles stop being ansible templates: their version vars are now
  --build-arg, read by the workflow out of the same defaults/main.yml the role
  interpolates, so CI and ansible build the same bytes from one set of pins.
- LABEL io.debyl.ci-base moves into each Containerfile so neither builder can
  forget the prune exemption; the workflow re-checks it before pushing.
- roles/gitea-actions pulls instead of building. gitea_ci_build_local=true
  restores the local build+push for seeding a cold registry or when CI is
  down -- the workflow that builds gitea-ci runs in gitea-ci.
- Lint .gitea/ alongside ansible/, and document the flow in the role README.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

ansible/roles/gitea-actions/tasks/images.yml

@@ -1,17 +1,10 @@
 ---
-# CI job images: stage each Containerfile, restore the image from the Gitea
-# registry if the nightly prune removed it, rebuild only when the Containerfile
-# changed, then push so the registry always holds what the runner uses.
-# See gitea_ci_images in defaults/main.yml.
-- name: create CI image build directory
-  become: true
-  become_user: "{{ gitea_runner_user }}"
-  ansible.builtin.file:
-    path: "{{ gitea_runner_home }}/ci-images"
-    state: directory
-    mode: "0755"
-  tags: gitea-actions
-
+# CI job images. .gitea/workflows/ci-images.yml builds files/Containerfile.*
+# and pushes them to the Gitea registry; this role only logs the runner in and
+# makes sure the images are present, so a plain deploy never waits on a build.
+#
+# Set gitea_ci_build_local=true to build and push from here instead -- see the
+# comment on that variable in defaults/main.yml.
 - name: create gitea-runner registry auth directory
   become: true
   become_user: "{{ gitea_runner_user }}"
@@ -21,6 +14,9 @@
     mode: "0700"
   tags: gitea-actions
 
+# Docker-format path on purpose: act_runner reads ~/.docker/config.json to
+# authenticate the job-image pull it does when a label's image is missing, and
+# podman falls back to the same file. One login covers both.
 - name: log gitea-runner in to the Gitea container registry
   become: true
   become_user: "{{ gitea_runner_user }}"
@@ -34,22 +30,7 @@
   no_log: true
   tags: gitea-actions
 
-- name: stage CI Containerfiles
-  become: true
-  become_user: "{{ gitea_runner_user }}"
-  ansible.builtin.template:
-    src: "{{ item.template }}"
-    dest: "{{ gitea_runner_home }}/ci-images/{{ item.containerfile }}"
-    mode: "0644"
-  loop: "{{ gitea_ci_images }}"
-  loop_control:
-    label: "{{ item.containerfile }}"
-  register: ci_containerfiles
-  tags: gitea-actions
-
-# A missing image here is normal (first push, or a new tag): the build below
-# creates it. Anything already present locally is left untouched.
-- name: restore CI images from the registry
+- name: pull CI images from the registry
   become: true
   become_user: "{{ gitea_runner_user }}"
   containers.podman.podman_image:
@@ -60,8 +41,35 @@
   loop: "{{ gitea_ci_images }}"
   loop_control:
     label: "{{ item.image }}"
-  when: not (ci_containerfiles.results | selectattr('item.image', 'equalto', item.image) | first).changed
-  failed_when: false
+  when: not (gitea_ci_build_local | bool)
+  tags: gitea-actions
+
+# --- local build fallback (gitea_ci_build_local=true) ------------------------
+# Only reached when seeding a new namespace or when CI cannot build for us.
+- name: create CI image build directory
+  become: true
+  become_user: "{{ gitea_runner_user }}"
+  ansible.builtin.file:
+    path: "{{ gitea_runner_home }}/ci-images"
+    state: directory
+    mode: "0755"
+  when: gitea_ci_build_local | bool
+  tags: gitea-actions
+
+# copy, not template: these are plain Containerfiles that CI builds verbatim.
+# Versions come in as --build-arg from the same defaults/main.yml the workflow
+# reads, so neither builder can drift from the other.
+- name: stage CI Containerfiles
+  become: true
+  become_user: "{{ gitea_runner_user }}"
+  ansible.builtin.copy:
+    src: "{{ item.containerfile }}"
+    dest: "{{ gitea_runner_home }}/ci-images/{{ item.containerfile }}"
+    mode: "0644"
+  loop: "{{ gitea_ci_images }}"
+  loop_control:
+    label: "{{ item.containerfile }}"
+  when: gitea_ci_build_local | bool
   tags: gitea-actions
 
 - name: build and push CI images
@@ -72,9 +80,8 @@
     path: "{{ gitea_runner_home }}/ci-images"
     build:
       file: "{{ gitea_runner_home }}/ci-images/{{ item.containerfile }}"
-      # Exempts the image from the nightly CI prune (gitea_ci_keep_label).
-      extra_args: "--label {{ gitea_ci_keep_label }}=true"
-    force: "{{ (ci_containerfiles.results | selectattr('item.image', 'equalto', item.image) | first).changed }}"
+      extra_args: "{{ item.build_args }}"
+    force: true
     push: true
     auth_file: "{{ gitea_ci_registry_authfile }}"
   environment:
@@ -82,4 +89,5 @@
   loop: "{{ gitea_ci_images }}"
   loop_control:
     label: "{{ item.image }}"
+  when: gitea_ci_build_local | bool
   tags: gitea-actions