feat(gitea-actions): build the CI job images in Gitea CI

The runner's job images were built by ansible into localhost/ only, so the
nightly CI prune deleted them and every idle stretch ended with CI failing in
under a second on `docker pull localhost/gitea-ci:latest` until someone re-ran
the role and waited out a rebuild. The previous commit moved them to the Gitea
registry; this moves the *build* off the deploy path entirely.

- .gitea/workflows/ci-images.yml builds files/Containerfile.* and pushes to
  git.debyl.io/gitbot/. Per-image change detection, so an ESP-IDF pin bump does
  not rebuild the other two; weekly schedule for base-image updates; a
  workflow_dispatch selector. PRs build under a throwaway :pr-<n> tag and drop
  it -- the build lands in the live runner's store, and act_runner will not
  re-pull a tag it already has, so a PR using the real tag would hand every
  later job on this host an unmerged image.
- The Containerfiles stop being ansible templates: their version vars are now
  --build-arg, read by the workflow out of the same defaults/main.yml the role
  interpolates, so CI and ansible build the same bytes from one set of pins.
- LABEL io.debyl.ci-base moves into each Containerfile so neither builder can
  forget the prune exemption; the workflow re-checks it before pushing.
- roles/gitea-actions pulls instead of building. gitea_ci_build_local=true
  restores the local build+push for seeding a cold registry or when CI is
  down -- the workflow that builds gitea-ci runs in gitea-ci.
- Lint .gitea/ alongside ansible/, and document the flow in the role README.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

ansible/roles/podman/defaults/main.yml

@@ -311,8 +311,13 @@ podman_prune_ci_users:
   - gitea-runner
   - actions-runner
 podman_prune_ci_until: 48h
-# CI base images built by roles/gitea-actions carry this label (gitea_ci_keep_label
-# there -- keep the two in sync) and are skipped by the CI image prune.
+# The CI base images declare LABEL io.debyl.ci-base="true" in
+# roles/gitea-actions/files/Containerfile.* (and .gitea/workflows/ci-images.yml
+# verifies it before publishing -- keep all three in sync). Images carrying it
+# are skipped below: `until` counts from build time and not pull time, so
+# without the exemption a re-pulled image would be deleted again the next
+# night, a 7.8 GB ESP-IDF re-download after every idle day. Superseded tags
+# (e.g. after an esp_idf_version bump) survive too; remove those by hand.
 podman_prune_ci_keep_label: io.debyl.ci-base
 
 # Daily rather than weekly: CI turns over many images a day, and a week of that

ansible/roles/podman/tasks/main.yml

@@ -123,7 +123,7 @@
 
 - import_tasks: containers/home/gregtime.yml
   vars:
-    image: localhost/greg-time-bot:3.18.1
+    image: localhost/greg-time-bot:3.18.3
   tags: gregtime
 
 # Built and loaded by `make deploy-remote` in ~/src/rsvp-debylio; bump this to