ci: prebuild the Arch environment as a container image

All six nightly jobs ran the same pacman transaction before doing any work.
The toolchain now lives in an image published to the Gitea registry as
git.bjphoster.com/aur/autoupdate:latest, rebuilt monthly since Arch is rolling
and a month-old image is a month behind.

The build job itself runs on plain ubuntu-latest -- it only drives docker. Only
the image is Arch.

Based on archlinux:base rather than base-devel: the autoupdater parses
PKGBUILDs and never compiles, so the toolchain is dead weight, 822 MB against
1.48 GB. nodejs is included because actions/checkout is a JavaScript action the
runner executes with node from inside the image.

Slimming to base initially dropped diffutils, and apply_pkgrel_rule used
diff -q. A missing binary makes the `if` fail, which reads as "changed", so
pkgrel ratcheted upward on every run -- the same silent-wrong-default class as
the empty .SRCINFO this rewrite was about, and invisible to the host test run.
The comparison is now a shell string equality with no external dependency, and
is verified against an image with no diff at all. require_tools() additionally
fails on startup for any missing binary rather than midway through.

README.md

@@ -103,9 +103,48 @@ The trap the previous implementation fell into was giving that same silent
 
 Needs a genuine Arch `makepkg`. Ubuntu's build environment emits an empty
 `.SRCINFO`, which the AUR rejects — this silently broke three packages. The CI
-job therefore runs in an `archlinux:base-devel` container as a non-root user
-(`makepkg` refuses to run as root), and `regen_srcinfo` in `common.sh` fails
-loudly if the output is ever empty again.
+job therefore runs in an Arch container as a non-root user (`makepkg` refuses to
+run as root), and `regen_srcinfo` in `common.sh` fails loudly if the output is
+ever empty again.
+
+`autoupdate.sh` calls `require_tools` on startup, so a missing binary fails
+immediately instead of taking a silently wrong branch further in.
+
+## Container image
+
+`dockerfile` builds the environment the nightly job runs in, published to the
+Gitea registry as `git.bjphoster.com/aur/autoupdate:latest`. Without it, all six
+matrix jobs would run a full `pacman` transaction every night.
+
+`.gitea/workflows/build-image.yaml` rebuilds and overwrites `:latest` monthly
+(Arch is rolling, so a month-old image is a month behind), on any push touching
+the `dockerfile`, and on demand via `workflow_dispatch`. That job runs on plain
+`ubuntu-latest` — it only drives `docker`; the *image* is the Arch part.
+
+Based on `archlinux:base`, not `base-devel`: the autoupdater only ever parses
+PKGBUILDs and never compiles, so the toolchain is dead weight — 822 MB against
+1.48 GB. Add it back if a real build or verify step is ever introduced.
+
+Building locally:
+
+```sh
+docker build -t git.bjphoster.com/aur/autoupdate:latest .
+docker run --rm -v "$PWD:/src:ro" git.bjphoster.com/aur/autoupdate:latest \
+  bash -c 'cp -r /src /w && chown -R builder:builder /w && cd /w &&
+           runuser -u builder -- ./test.sh'
+```
+
+Running the suite inside the image is worth doing after any `dockerfile` change.
+Trimming to `archlinux:base` originally dropped `diffutils`, and the missing
+`diff` made every run look like a packaging change and ratchet `pkgrel` upward —
+the host tests passed throughout. `pkgrel` no longer depends on `diff` at all,
+but the lesson stands.
+
+### Registry credentials
+
+Needs `vars.REGISTRY_USER` — your Gitea **username**, not `vars.GIT_NAME`, which
+is the display name used for commit authorship and contains spaces. The token is
+the existing `secrets.GIT_TOKEN`, which needs `write:package` scope.
 
 ## Notes on checksums