ci: no quick check on master after a merge (#119); the runner image's recipe (#120)

Captain Bob, 2026-11-06: a small server, a little sluggish. Each change
cost about an hour of runner time; the gate itself is about 15 minutes.

#119 -- build.yml runs on pushes to the working branch only. What
reaches master arrives through a PR whose content just passed
acceptance; checking it again cost ~23 minutes after every merge.

#120, first step -- ci/runner-image/Dockerfile: gitea/runner-images'
Ubuntu 24.04 (with Node, for the actions) plus what
make ARCH=amd64,aarch64,riscv64 init INIT_DOCS=0 installs -- run from
the Makefile itself, not a copied list -- and Maven for publishing.
.gitea/workflows/runner-image.yml builds it and publishes it to the
package registry as lithosananke-runner:<commit>. The workflows switch
to it in a later change, once it is published and has passed
acceptance. It needs the runner to lend jobs its Docker daemon
(container.docker_host: automount) and a PACKAGES_TOKEN secret, unless
the Actions token may publish packages.

make init does git lfs install --local only inside a checkout: the
image build is not one.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

.gitea/workflows/build.yml

@@ -1,5 +1,6 @@
-# The quick check on every push: each board's image builds, and the v4 tests pass. A pull
-# request into master is gated by acceptance.yml, the full acceptance protocol.
+# The quick check on every push to the working branch: each board's image builds, and the v4
+# tests pass. A pull request into master is gated by acceptance.yml, the full acceptance protocol;
+# master itself is not checked again after a merge -- its content is what acceptance just passed.
 # Nothing is published here. The nightlies own the rest: nightly.yml (the QEMU acceptance boots,
 # the 32-bit build, the Isabelle/HOL proofs, the images to Nexus) and nightly-docs.yml (the
 # documents to Nexus).
@@ -7,7 +8,7 @@ name: Build
 
 on:
   push:
-    branches: [master, StarForth-v4.0.0]
+    branches: [StarForth-v4.0.0]   # not master: what reaches it has just passed acceptance (#119)
   workflow_dispatch:
 
 jobs:

.gitea/workflows/runner-image.yml

@@ -0,0 +1,49 @@
+# Builds the CI runner image (ci/runner-image/Dockerfile, #120) and publishes it to this
+# repository's package registry, tagged with the commit it was built from:
+#
+#   gitea.starshipos-f18.org/rajames/lithosananke-runner:<commit>
+#
+# The workflows name that tag as their container once it is published and has passed acceptance.
+#
+# Needs the runner to give jobs its Docker daemon (act_runner config.yaml, container.docker_host:
+# automount), and a secret PACKAGES_TOKEN -- a token with write:package -- unless the Actions
+# token may publish packages here.
+name: Runner image
+
+on:
+  push:
+    branches: [master]
+    paths: ['ci/runner-image/**', 'Makefile']
+  workflow_dispatch:
+
+jobs:
+  image:
+    name: Build and publish the runner image
+    runs-on: ubuntu-latest
+    container:
+      image: gitea/runner-images:ubuntu-24.04-v26.11.03
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          lfs: false
+
+      - name: Docker is reachable
+        run: |
+          docker info >/dev/null 2>&1 || {
+            echo "::error::No Docker daemon in this job. Set container.docker_host: automount in the runner's config.yaml, or build the image on the server: see this file's header."
+            exit 1; }
+
+      - name: Build and publish
+        env:
+          TOKEN: ${{ secrets.PACKAGES_TOKEN || secrets.GITEA_TOKEN }}
+        run: |
+          set -e
+          img=gitea.starshipos-f18.org/rajames/lithosananke-runner
+          tag=$(git rev-parse --short=12 HEAD)
+          ctx=$(mktemp -d)                                  # not the repository: 7 GB of context
+          cp -r Makefile boards ci/runner-image/Dockerfile "$ctx/"
+          docker build -t "$img:$tag" "$ctx"
+          echo "$TOKEN" | docker login gitea.starshipos-f18.org -u rajames --password-stdin
+          docker push "$img:$tag"
+          echo "Published $img:$tag"