feat(ci): build and push runner image with kaniko

Daemonless image build inside the job container itself
(kaniko :debug). Source fetched via Gitea archive API, pushed to the
Gitea registry tagged with the short commit SHA. Triggered by changes
to Dockerfile, any pipeline requirements.txt, or this workflow.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/build-image.yml

@@ -0,0 +1,51 @@
+on:
+  push:
+    branches: [master]
+    paths:
+      - Dockerfile
+      - "pipelines/**/requirements.txt"
+      - .gitea/workflows/build-image.yml
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    container:
+      # Daemonless image builder; :debug variant ships a busybox shell so
+      # act can exec steps inside it. No docker socket, no privileges.
+      image: gcr.io/kaniko-project/executor:v1.23.2-debug
+
+    steps:
+      - name: Fetch source, build, push
+        # kaniko image has no bash — busybox sh only
+        shell: sh
+        env:
+          PKG_TOKEN: ${{ secrets.PKG_TOKEN }}
+          URL_TO_GITEA: ${{ vars.URL_TO_GITEA }}
+        run: |
+          set -eu
+          HOST="${URL_TO_GITEA#http://}"
+          SHORT_SHA=$(echo "${GITHUB_SHA}" | cut -c1-7)
+          IMAGE="${HOST}/mikkeli/novoyuuparosk-wiki-runner"
+
+          # Source via Gitea archive API (no git/node in this image; repo is
+          # public so the download is anonymous — PKG_TOKEN is push-only)
+          wget -qO /tmp/src.tar.gz \
+            "http://${HOST}/api/v1/repos/mikkeli/novoyuuparosk-auto-wiki/archive/${GITHUB_SHA}.tar.gz"
+          mkdir -p /tmp/src
+          tar -xzf /tmp/src.tar.gz -C /tmp/src --strip-components=1
+
+          # Registry auth for the push
+          AUTH=$(printf '%s' "mikkeli:${PKG_TOKEN}" | base64 | tr -d '\n')
+          printf '{"auths":{"%s":{"auth":"%s"}}}' "${HOST}" "${AUTH}" \
+            > /kaniko/.docker/config.json
+
+          # --insecure: push target is the plain-HTTP Gitea registry.
+          # Base image pull (docker.io) stays HTTPS — no --insecure-pull.
+          /kaniko/executor \
+            --context dir:///tmp/src \
+            --dockerfile /tmp/src/Dockerfile \
+            --destination "${IMAGE}:${SHORT_SHA}" \
+            --insecure
+
+          echo "Pushed ${IMAGE}:${SHORT_SHA}"