ci: run the jobs in the runner image (#120)

The workflows' containers are now lithosananke-runner:72b6cf370db1, built
and published by runner-image.yml, with everything init installs and Maven
already in it; the install steps are gone, except the documents' packages in
nightly-docs.yml and release.yml. The registry refuses anonymous pulls, so
each job pulls with PACKAGES_TOKEN.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

.gitea/workflows/nightly-docs.yml

@@ -19,7 +19,10 @@ jobs:
     name: Book, volumes, API reference
     runs-on: ubuntu-latest
     container:
-      image: gitea/runner-images:ubuntu-24.04-v26.11.03   # the runner's own ubuntu-latest is Debian 11 (node:20-bullseye)
+      image: gitea.starshipos-f18.org/rajames/lithosananke-runner:72b6cf370db1   # ci/runner-image (#120)
+      credentials:                # the registry refuses anonymous pulls
+        username: rajames
+        password: ${{ secrets.PACKAGES_TOKEN }}
     timeout-minutes: 90
     steps:
       - uses: actions/checkout@v4
@@ -28,9 +31,7 @@ jobs:
           lfs: false
 
       - name: Install the documents' dependencies
-        run: |
-          make ARCH=amd64 init INIT_PROOFS=0
-          DEBIAN_FRONTEND=noninteractive apt-get install -y -qq maven default-jre-headless
+        run: make ARCH=amd64 init INIT_PROOFS=0   # the image has all but the documents' packages
 
       - name: Documents
         run: scripts/nightly.sh docs