Template
Same change as template-go-agent. A template that carries the build LOGIC manufactures a private fork of it in every generated repo; one that carries a CALL manufactures nothing. That distinction is what made infra#241 a nine-repo sprint plus two rediscoveries in the templates. Invoked as `bash .gitea/build-image.sh` -- files written through the Gitea API land 0644, and CI that depends on a file mode is a trap for every repo generated from here.