ci: prebuild the Arch environment as a container image

All six nightly jobs ran the same pacman transaction before doing any work.
The toolchain now lives in an image published to the Gitea registry as
git.bjphoster.com/aur/autoupdate:latest, rebuilt monthly since Arch is rolling
and a month-old image is a month behind.

The build job itself runs on plain ubuntu-latest -- it only drives docker. Only
the image is Arch.

Based on archlinux:base rather than base-devel: the autoupdater parses
PKGBUILDs and never compiles, so the toolchain is dead weight, 822 MB against
1.48 GB. nodejs is included because actions/checkout is a JavaScript action the
runner executes with node from inside the image.

Slimming to base initially dropped diffutils, and apply_pkgrel_rule used
diff -q. A missing binary makes the `if` fail, which reads as "changed", so
pkgrel ratcheted upward on every run -- the same silent-wrong-default class as
the empty .SRCINFO this rewrite was about, and invisible to the host test run.
The comparison is now a shell string equality with no external dependency, and
is verified against an image with no diff at all. require_tools() additionally
fails on startup for any missing binary rather than midway through.

common.sh

@@ -17,6 +17,19 @@ die()  { printf 'ERROR: %s\n' "$*" >&2; exit 1; }
 # The old push.sh fell back to an interactive `read` when no version was passed.
 # In CI that reads EOF and yields an empty version, which is how pman-helper
 # committed pkgver="" and the sha256 of a zero-byte download.
+# Fail up front on a missing tool rather than midway through, where an absent
+# binary tends to be read as "condition false" and silently takes the wrong
+# branch. `diff` going missing in a slimmer base image did exactly that: it made
+# every run look like a packaging change and ratcheted pkgrel upward.
+require_tools() {
+  local t missing=()
+  for t in git curl jq sha256sum awk sed grep makepkg; do
+    command -v "$t" >/dev/null 2>&1 || missing+=("$t")
+  done
+  [ "${#missing[@]}" -eq 0 ] || die "missing required tool(s): ${missing[*]}"
+  return 0
+}
+
 require_noninteractive() {
   [ -t 0 ] && die "refusing to prompt: this script must never depend on interactive input"
   return 0