ci: call the shared build-image script instead of an inline copy (infra#309)

Wave 2. The buildctl/skopeo step here was one of nineteen near-identical
copies; the implementation now lives in .gitea/build-image.sh,
byte-identical to mathias/infra's ci-templates/build-image.sh and held
there by a drift gate. Labels, tags and build-args are inputs.

Behaviour unchanged: same registry, same :sha/:latest/version tags, same
revision and source labels.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011PL5XcG68SvQqz3vGVbWbf

.gitea/workflows/cd.yml

@@ -58,53 +58,27 @@ jobs:
           REF="${{ github.ref }}"
           if [[ "$REF" == refs/tags/v* ]]; then
             echo "version-tag=${REF#refs/tags/}" >> "$GITHUB_OUTPUT"
+            echo "version=${REF#refs/tags/}" >> "$GITHUB_OUTPUT"
+          else
+            # The ldflags version stamp: git tag on a v* build, else short sha.
+            # Computed here in shell, not as a `${{ a || b }}` expression, so it
+            # cannot depend on how the runner treats an empty step output -- a
+            # wrong VERSION would be baked into the binary silently.
+            echo "version=${SHA}" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Build and push to local registry
-        run: |
-          set -e
-          # infra#241: buildctl, not buildah. Rootless buildah in gitea-runner's
-          # hardened securityContext (capabilities drop ALL,
-          # allowPrivilegeEscalation false) cannot remap the UID/GID range
-          # newuidmap/newgidmap need on a fresh base-image pull, and the pod has
-          # no OCI runtime at all -- so this Dockerfile's `RUN apk add` / `RUN go
-          # build` could not execute there either. buildctl is a thin client
-          # that hands the build to the host's buildkitd over a socket, so the
-          # privileged layer work happens on the host and this pod's
-          # securityContext stops being in the picture. Same pattern as
-          # mathias/infra's segment-embedder.yml.
-          BUILDKIT_HOST="unix:///run/buildkit/buildkitd.sock"
-          REGISTRY="localhost:5000"
-          REF="${REGISTRY}/${{ env.IMAGE }}:${{ steps.meta.outputs.sha-tag }}"
-          # Stamp the real build version: the git tag on a v* build, else the short sha.
-          VERSION="${{ steps.meta.outputs.version-tag }}"
-          # `if`, not `[ -z ] &&`: under `set -e` the && form exits the step
-          # whenever VERSION is already set.
-          if [ -z "$VERSION" ]; then VERSION="${{ steps.meta.outputs.sha-tag }}"; fi
-          TAR_FILE="$(mktemp)"
-          trap 'rm -f "$TAR_FILE"' EXIT
-
-          buildctl --addr "$BUILDKIT_HOST" build \
-            --frontend dockerfile.v0 \
-            --local context=. \
-            --local dockerfile=. \
-            --opt build-arg:VERSION="${VERSION}" \
-            --opt label:org.opencontainers.image.revision="${{ github.sha }}" \
-            --opt label:org.opencontainers.image.source="${{ github.repositoryUrl }}" \
-            --output type=oci,dest="$TAR_FILE"
-
-          # buildctl has no registry-push equivalent to `buildah push`; skopeo
-          # copies the OCI archive up, once per tag.
-          skopeo copy --dest-tls-verify=false \
-            oci-archive:"$TAR_FILE" docker://${REF}
-          skopeo copy --dest-tls-verify=false \
-            oci-archive:"$TAR_FILE" docker://${REGISTRY}/${{ env.IMAGE }}:latest
-          if [ -n "${{ steps.meta.outputs.version-tag }}" ]; then
-            skopeo copy --dest-tls-verify=false \
-              oci-archive:"$TAR_FILE" \
-              docker://${REGISTRY}/${{ env.IMAGE }}:${{ steps.meta.outputs.version-tag }}
-          fi
-          echo "✓ Image pushed to ${REF}"
+      # infra#309: implementation lives in .gitea/build-image.sh, a
+      # byte-identical copy of mathias/infra's ci-templates/build-image.sh.
+      # Do not edit it here -- edit the canonical file, run `task ci:sync`,
+      # and infra's drift gate names any repo still carrying an old copy.
+        env:
+          SHA_TAG: ${{ steps.meta.outputs.sha-tag }}
+          VERSION_TAG: ${{ steps.meta.outputs.version-tag }}
+          GIT_SHA: ${{ github.sha }}
+          IMAGE_SOURCE: ${{ github.repositoryUrl }}
+          BUILD_ARGS: VERSION=${{ steps.meta.outputs.version }}
+        run: bash .gitea/build-image.sh
 
       # No smoke test here. The old one ran `sudo k3s ctr run` against the host's
       # containerd: written for the Arch host runner, impossible in the