ci: no quick check on master after a merge (#119); the runner image's recipe (#120)

Captain Bob, 2026-11-06: a small server, a little sluggish. Each change
cost about an hour of runner time; the gate itself is about 15 minutes.

#119 -- build.yml runs on pushes to the working branch only. What
reaches master arrives through a PR whose content just passed
acceptance; checking it again cost ~23 minutes after every merge.

#120, first step -- ci/runner-image/Dockerfile: gitea/runner-images'
Ubuntu 24.04 (with Node, for the actions) plus what
make ARCH=amd64,aarch64,riscv64 init INIT_DOCS=0 installs -- run from
the Makefile itself, not a copied list -- and Maven for publishing.
.gitea/workflows/runner-image.yml builds it and publishes it to the
package registry as lithosananke-runner:<commit>. The workflows switch
to it in a later change, once it is published and has passed
acceptance. It needs the runner to lend jobs its Docker daemon
(container.docker_host: automount) and a PACKAGES_TOKEN secret, unless
the Actions token may publish packages.

make init does git lfs install --local only inside a checkout: the
image build is not one.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

Makefile

@@ -314,7 +314,8 @@ init:
 	$(SUDO) env DEBIAN_FRONTEND=noninteractive apt-get update -qq
 	$(SUDO) env DEBIAN_FRONTEND=noninteractive apt-get install -y -qq \
 	    $(INIT_COMMON) $(if $(filter 0,$(INIT_DOCS)),,$(INIT_DOCPKGS)) $(foreach a,$(INIT_ARCHES),$(INIT_$(a)))
-	git lfs install --local
+	@# the LFS hook for this checkout -- none when init runs outside one (the CI image, ci/runner-image)
+	if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then git lfs install --local; fi
 	$(call fetch,$(SYFT_TGZ),$(SYFT_URL),$(SYFT_SHA_$(SYFT_ARCH)))
 	@mkdir -p $(INIT_TOOLS)/syft-$(SYFT_VERSION)
 	tar -xzf $(INIT_DL)/$(SYFT_TGZ) -C $(INIT_TOOLS)/syft-$(SYFT_VERSION) syft