ci: prebuild the Arch environment as a container image

All six nightly jobs ran the same pacman transaction before doing any work.
The toolchain now lives in an image published to the Gitea registry as
git.bjphoster.com/aur/autoupdate:latest, rebuilt monthly since Arch is rolling
and a month-old image is a month behind.

The build job itself runs on plain ubuntu-latest -- it only drives docker. Only
the image is Arch.

Based on archlinux:base rather than base-devel: the autoupdater parses
PKGBUILDs and never compiles, so the toolchain is dead weight, 822 MB against
1.48 GB. nodejs is included because actions/checkout is a JavaScript action the
runner executes with node from inside the image.

Slimming to base initially dropped diffutils, and apply_pkgrel_rule used
diff -q. A missing binary makes the `if` fail, which reads as "changed", so
pkgrel ratcheted upward on every run -- the same silent-wrong-default class as
the empty .SRCINFO this rewrite was about, and invisible to the host test run.
The comparison is now a shell string equality with no external dependency, and
is verified against an image with no diff at all. require_tools() additionally
fails on startup for any missing binary rather than midway through.

dockerfile

@@ -0,0 +1,49 @@
+# Build environment for the AUR autoupdater.
+#
+# Rebuilt monthly by .gitea/workflows/build-image.yaml and pushed as :latest, so
+# the six nightly package jobs start with the toolchain already in place instead
+# of each running a full pacman transaction first.
+#
+# Arch specifically: makepkg --printsrcinfo must be the genuine Arch tool.
+# Ubuntu's build environment silently emits an empty .SRCINFO, which the AUR
+# then rejects -- that is what broke three packages before this was rewritten.
+
+# base, not base-devel: the autoupdater only ever *parses* PKGBUILDs
+# (makepkg --printsrcinfo) and never compiles anything, so the toolchain in
+# base-devel is dead weight -- 822 MB against 1.48 GB. If a real build or
+# verify step is ever added here, this needs to go back to base-devel.
+FROM archlinux:base
+
+LABEL org.opencontainers.image.title="aur-autoupdate"
+LABEL org.opencontainers.image.description="Arch build environment for the AUR package autoupdater"
+LABEL org.opencontainers.image.source="https://git.bjphoster.com/aur/.autoupdate"
+
+# nodejs        actions/checkout is a JavaScript action; the runner executes it
+#               with `node` from inside this image, and base-devel has none.
+# pacman-contrib updpkgsums/paccache and friends
+# namcap        PKGBUILD linting
+# fuse2         AppImage extraction
+# python        test.sh's local HTTP server
+RUN pacman -Syu --noconfirm --needed \
+      nodejs \
+      git \
+      openssh \
+      jq \
+      curl \
+      pacman-contrib \
+      namcap \
+      fuse2 \
+      python \
+      diffutils \
+ && rm -rf /var/cache/pacman/pkg/*
+# NB: not `pacman -Scc` -- under --noconfirm it takes the default answer, which
+# is *no* for the cache prompt, so it drops sync databases (breaking pacman -Ss
+# for debugging) without actually reclaiming the cache. The rm does the real work.
+
+# makepkg refuses to run as root and CI containers are root by default, so the
+# nightly job drops to this user. Baked in here rather than created per run.
+RUN useradd --create-home --shell /bin/bash builder
+
+# Sanity check: fail the image build rather than the nightly job if makepkg
+# ever stops working in this environment.
+RUN runuser -u builder -- bash -c 'command -v makepkg && makepkg --version | head -1'