fix(ci): wrap kaniko in act-compatible image

act starts job containers with entrypoint /bin/sleep, which kaniko's
scratch-based image lacks (busybox lives under /busybox). kaniko-act
adds the single missing symlink; bootstrap build is manual, documented
in the Dockerfile.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

ci/Dockerfile.kaniko-act

@@ -0,0 +1,13 @@
+# Kaniko executor adapted for Gitea act_runner job containers.
+#
+# act starts job containers with entrypoint /bin/sleep; kaniko's image
+# already symlinks /bin/sh -> /busybox/sh but ships no /bin/sleep.
+# This wrapper adds that one symlink. Nothing else changes.
+#
+# Bootstrap: the first build of this image is done manually on the host
+# (docker build -f ci/Dockerfile.kaniko-act -t <registry>/mikkeli/kaniko-act:<ver> .)
+# because no builder image exists yet. Later version bumps can be built by
+# the build-image workflow itself, using the previous kaniko-act.
+FROM gcr.io/kaniko-project/executor:v1.23.2-debug
+SHELL ["/busybox/sh", "-c"]
+RUN ln -sf /busybox/sleep /bin/sleep