ci: build via buildctl instead of rootless buildah (infra#241)

cad-atlas is the eighth repo to hit this wall, and it only surfaced now because
the build job had been unreachable behind a failing test job:

  error running container: from  creating container for
  [/bin/sh -c apk add --no-cache git]: : exec: no command

Root cause is the gitea-runner pod's securityContext, not this repo: it drops
ALL capabilities and sets allowPrivilegeEscalation:false, so newuidmap and
newgidmap cannot remap uids and rootless buildah gets a single non-remapped
mapping — not enough to set up a RUN step's user namespace.

buildctl talks to koala's host buildkitd over the socket the runner pod already
mounts, so the privileged layer work happens on the host and the pod keeps its
minimal posture. Same migration dispatch, tapir, brain-ingest-ntfy, parallax,
macro-research, cobalt-dingo, agentsquad (infra#233) and segment-embedder
(infra#243) have already made.

Note --opt build-arg:VERSION replaces buildah's --build-arg; the version label
this repo stamps into its binary depends on it, and dropping it silently would
have produced an image reporting the wrong version.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011PL5XcG68SvQqz3vGVbWbf

.gitea/workflows/cd.yml

@@ -143,16 +143,37 @@ jobs:
 
       - name: Build and push to local registry
         run: |
+          set -euo pipefail
+          # infra#241: rootless buildah cannot build this Dockerfile in the
+          # gitea-runner pod — it drops ALL capabilities and sets
+          # allowPrivilegeEscalation:false (deliberate, it holds CI secrets), so
+          # newuidmap/newgidmap cannot remap uids and `RUN apk add` dies with
+          # "exec: no command". Every other repo on this runner has already
+          # moved: dispatch, tapir, brain-ingest-ntfy, parallax, macro-research,
+          # cobalt-dingo, agentsquad (infra#233), segment-embedder (infra#243).
+          #
+          # buildctl talks to koala's host buildkitd over the socket the runner
+          # pod already mounts, so the privileged work happens on the host and
+          # this pod's posture is irrelevant to whether the build succeeds.
+          # buildctl cannot push, so it writes an OCI archive that skopeo copies.
+          BUILDKIT_HOST="unix:///run/buildkit/buildkitd.sock"
           REGISTRY="localhost:5000"
           REF="${REGISTRY}/${{ env.IMAGE }}:${{ steps.meta.outputs.sha-tag }}"
-          buildah build \
-            --build-arg VERSION="${{ steps.meta.outputs.version }}" \
-            --label "org.opencontainers.image.revision=${{ github.sha }}" \
-            -t ${REF} \
-            -t ${REGISTRY}/${{ env.IMAGE }}:latest \
-            .
-          buildah push --tls-verify=false ${REF}
-          buildah push --tls-verify=false ${REGISTRY}/${{ env.IMAGE }}:latest
+          TAR_FILE="$(mktemp)"
+          trap 'rm -f "$TAR_FILE"' EXIT
+
+          buildctl --addr "$BUILDKIT_HOST" build \
+            --frontend dockerfile.v0 \
+            --local context=. \
+            --local dockerfile=. \
+            --opt build-arg:VERSION="${{ steps.meta.outputs.version }}" \
+            --opt label:org.opencontainers.image.revision="${{ github.sha }}" \
+            --output type=oci,dest="$TAR_FILE"
+
+          skopeo copy --dest-tls-verify=false \
+            oci-archive:"$TAR_FILE" docker://"${REF}"
+          skopeo copy --dest-tls-verify=false \
+            oci-archive:"$TAR_FILE" docker://"${REGISTRY}/${{ env.IMAGE }}:latest"
           echo "✓ Image pushed to ${REF}"
 
   deploy: