ci: call the shared build-image script instead of an inline copy (infra#309)

The buildctl/skopeo step here was one of nineteen near-identical copies
across the estate. That duplication is why moving them off rootless
buildah (infra#241) took eleven commits and then had to be rediscovered
in both repo templates and the gitea-ci skill.

The implementation now lives in .gitea/build-image.sh, byte-identical to
mathias/infra's ci-templates/build-image.sh and held there by a drift
gate. What used to be textual differences between copies -- labels, tags,
build-args, build target -- are environment inputs.

Behaviour is unchanged: same registry, same tags, same labels, same
buildctl-against-host-buildkitd path.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011PL5XcG68SvQqz3vGVbWbf

.gitea/workflows/ci.yml

@@ -77,32 +77,16 @@ jobs:
       # and skopeo pushes that, which is also why every tag below is one copy of
       # a single build rather than a rebuild.
       - name: Build and push to local registry
-        run: |
-          set -euo pipefail
-          BUILDKIT_HOST="unix:///run/buildkit/buildkitd.sock"
-          REGISTRY="localhost:5000"
-          REF="${REGISTRY}/${{ env.IMAGE }}:${{ steps.meta.outputs.sha-tag }}"
-          TAR_FILE="$(mktemp)"
-          trap 'rm -f "$TAR_FILE"' EXIT
-
-          buildctl --addr "$BUILDKIT_HOST" build \
-            --frontend dockerfile.v0 \
-            --local context=. \
-            --local dockerfile=. \
-            --opt label:org.opencontainers.image.revision="${{ github.sha }}" \
-            --opt label:org.opencontainers.image.source="${{ github.repositoryUrl }}" \
-            --output type=oci,dest="$TAR_FILE"
-
-          skopeo copy --dest-tls-verify=false \
-            oci-archive:"$TAR_FILE" docker://"${REF}"
-          skopeo copy --dest-tls-verify=false \
-            oci-archive:"$TAR_FILE" docker://"${REGISTRY}/${{ env.IMAGE }}:latest"
-          if [[ -n "${{ steps.meta.outputs.version-tag }}" ]]; then
-            skopeo copy --dest-tls-verify=false \
-              oci-archive:"$TAR_FILE" \
-              docker://"${REGISTRY}/${{ env.IMAGE }}:${{ steps.meta.outputs.version-tag }}"
-          fi
-          echo "Image pushed to ${REF}"
+      # infra#309: implementation lives in .gitea/build-image.sh, a
+      # byte-identical copy of mathias/infra's ci-templates/build-image.sh.
+      # Do not edit it here -- edit the canonical file, run `task ci:sync`,
+      # and infra's drift gate names any repo still carrying an old copy.
+        env:
+          SHA_TAG: ${{ steps.meta.outputs.sha-tag }}
+          VERSION_TAG: ${{ steps.meta.outputs.version-tag }}
+          GIT_SHA: ${{ github.sha }}
+          IMAGE_SOURCE: ${{ github.repositoryUrl }}
+        run: bash .gitea/build-image.sh
 
       # The buildah-based smoke test that used to sit here is gone with the
       # buildctl migration above: `buildah from ${REF}` would pull the image