ci: call the shared build-image script instead of an inline copy (infra#309)

The buildctl/skopeo step here was one of nineteen near-identical copies
across the estate. That duplication is why moving them off rootless
buildah (infra#241) took eleven commits and then had to be rediscovered
in both repo templates and the gitea-ci skill.

The implementation now lives in .gitea/build-image.sh, byte-identical to
mathias/infra's ci-templates/build-image.sh and held there by a drift
gate. What used to be textual differences between copies -- labels, tags,
build-args, build target -- are environment inputs.

Behaviour is unchanged: same registry, same tags, same labels, same
buildctl-against-host-buildkitd path.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011PL5XcG68SvQqz3vGVbWbf

.gitea/workflows/cd.yml

@@ -142,39 +142,15 @@ jobs:
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
 
       - name: Build and push to local registry
-        run: |
-          set -euo pipefail
-          # infra#241: rootless buildah cannot build this Dockerfile in the
-          # gitea-runner pod — it drops ALL capabilities and sets
-          # allowPrivilegeEscalation:false (deliberate, it holds CI secrets), so
-          # newuidmap/newgidmap cannot remap uids and `RUN apk add` dies with
-          # "exec: no command". Every other repo on this runner has already
-          # moved: dispatch, tapir, brain-ingest-ntfy, parallax, macro-research,
-          # cobalt-dingo, agentsquad (infra#233), segment-embedder (infra#243).
-          #
-          # buildctl talks to koala's host buildkitd over the socket the runner
-          # pod already mounts, so the privileged work happens on the host and
-          # this pod's posture is irrelevant to whether the build succeeds.
-          # buildctl cannot push, so it writes an OCI archive that skopeo copies.
-          BUILDKIT_HOST="unix:///run/buildkit/buildkitd.sock"
-          REGISTRY="localhost:5000"
-          REF="${REGISTRY}/${{ env.IMAGE }}:${{ steps.meta.outputs.sha-tag }}"
-          TAR_FILE="$(mktemp)"
-          trap 'rm -f "$TAR_FILE"' EXIT
-
-          buildctl --addr "$BUILDKIT_HOST" build \
-            --frontend dockerfile.v0 \
-            --local context=. \
-            --local dockerfile=. \
-            --opt build-arg:VERSION="${{ steps.meta.outputs.version }}" \
-            --opt label:org.opencontainers.image.revision="${{ github.sha }}" \
-            --output type=oci,dest="$TAR_FILE"
-
-          skopeo copy --dest-tls-verify=false \
-            oci-archive:"$TAR_FILE" docker://"${REF}"
-          skopeo copy --dest-tls-verify=false \
-            oci-archive:"$TAR_FILE" docker://"${REGISTRY}/${{ env.IMAGE }}:latest"
-          echo "✓ Image pushed to ${REF}"
+      # infra#309: implementation lives in .gitea/build-image.sh, a
+      # byte-identical copy of mathias/infra's ci-templates/build-image.sh.
+      # Do not edit it here -- edit the canonical file, run `task ci:sync`,
+      # and infra's drift gate names any repo still carrying an old copy.
+        env:
+          SHA_TAG: ${{ steps.meta.outputs.sha-tag }}
+          GIT_SHA: ${{ github.sha }}
+          BUILD_ARGS: VERSION=${{ steps.meta.outputs.version }}
+        run: bash .gitea/build-image.sh
 
   deploy:
     name: Deploy via GitOps