ci: run the jobs in the runner image (#120)

The workflows' containers are now lithosananke-runner:72b6cf370db1, built
and published by runner-image.yml, with everything init installs and Maven
already in it; the install steps are gone, except the documents' packages in
nightly-docs.yml and release.yml. The registry refuses anonymous pulls, so
each job pulls with PACKAGES_TOKEN.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

.gitea/workflows/release.yml

@@ -22,7 +22,10 @@ jobs:
     name: Release ${{ github.ref_name }}
     runs-on: ubuntu-latest
     container:
-      image: gitea/runner-images:ubuntu-24.04-v26.11.03   # the runner's own ubuntu-latest is Debian 11 (node:20-bullseye)
+      image: gitea.starshipos-f18.org/rajames/lithosananke-runner:72b6cf370db1   # ci/runner-image (#120)
+      credentials:                # the registry refuses anonymous pulls
+        username: rajames
+        password: ${{ secrets.PACKAGES_TOKEN }}
     timeout-minutes: 240
     steps:
       - uses: actions/checkout@v4
@@ -38,9 +41,7 @@ jobs:
           echo "NIGHTLY_VERSION=${tree#v}" >> "$GITHUB_ENV"
 
       - name: Install the dependencies
-        run: |
-          make ARCH=amd64,aarch64,riscv64 init
-          DEBIAN_FRONTEND=noninteractive apt-get install -y -qq maven default-jre-headless
+        run: make ARCH=amd64,aarch64,riscv64 init   # the image has all but the documents' packages
 
       - name: Acceptance amd64
         run: scripts/nightly.sh accept amd64