ci: prebuild the Arch environment as a container image

All six nightly jobs ran the same pacman transaction before doing any work.
The toolchain now lives in an image published to the Gitea registry as
git.bjphoster.com/aur/autoupdate:latest, rebuilt monthly since Arch is rolling
and a month-old image is a month behind.

The build job itself runs on plain ubuntu-latest -- it only drives docker. Only
the image is Arch.

Based on archlinux:base rather than base-devel: the autoupdater parses
PKGBUILDs and never compiles, so the toolchain is dead weight, 822 MB against
1.48 GB. nodejs is included because actions/checkout is a JavaScript action the
runner executes with node from inside the image.

Slimming to base initially dropped diffutils, and apply_pkgrel_rule used
diff -q. A missing binary makes the `if` fail, which reads as "changed", so
pkgrel ratcheted upward on every run -- the same silent-wrong-default class as
the empty .SRCINFO this rewrite was about, and invisible to the host test run.
The comparison is now a shell string equality with no external dependency, and
is verified against an image with no diff at all. require_tools() additionally
fails on startup for any missing binary rather than midway through.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

autoupdate.sh

@@ -24,6 +24,7 @@ _here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${_here}/common.sh"
 
 require_noninteractive
+require_tools
 
 GIT_HOST="${GIT_HOST:-git.bjphoster.com}"
 # Where the package repos live, and how the upstream version is resolved.
@@ -191,8 +192,15 @@ apply_pkgrel_rule() {
   # packaging content. An edit to a local source lands here too, because its
   # sha256sums entry was just regenerated. A README-only edit does not touch
   # the PKGBUILD and so correctly does not bump.
-  if diff -q <(grep -v '^pkgrel=' PKGBUILD) \
-             <(grep -v '^pkgrel=' "$aur_pkgbuild") >/dev/null 2>&1; then
+  #
+  # Deliberately a shell string comparison rather than diff(1): diff lives in
+  # diffutils, which archlinux:base does not ship, and a missing binary makes
+  # the `if` fail, which reads as "changed" and ratchets pkgrel upward on every
+  # single run. Same silent-wrong-default class of bug as the empty .SRCINFO.
+  local local_body aur_body
+  local_body="$(grep -v '^pkgrel=' PKGBUILD)"
+  aur_body="$(grep -v '^pkgrel=' "$aur_pkgbuild")"
+  if [ "$local_body" = "$aur_body" ]; then
     return 0  # identical packaging; nothing to do
   fi