Template
A template is the highest-leverage copy of anything. This one carried its own inline build step, so every generated repo was born with a private fork of the build logic -- which is how rootless buildah reached a dozen repos before infra#241, and why the fix then had to be rediscovered here weeks after the app repos were done. The step now calls .gitea/build-image.sh, a byte-identical copy of mathias/infra's ci-templates/build-image.sh. Generated repos inherit the script and the call; adding the new repo to infra's adopters.txt puts it under the drift gate. Invoked as `bash .gitea/build-image.sh` rather than relying on the exec bit: files written through the Gitea API land 0644, and a template whose CI depends on a file mode is a trap for every repo generated from it.