Refactor dnsmasq to build as a container. Add signed iPXE image build

.gitea/workflows/dnsmasq-image.yaml

@@ -0,0 +1,68 @@
+#
+# .gitea/workflows/dnsmasq-image.yaml
+#
+# Builds the serving-stack dnsmasq image (serving/dnsmasq) and pushes it to the
+# registry, so serving hosts `docker compose pull` it instead of building it at
+# deploy time (matching the SPDK image). The image is GENERIC: it carries no
+# Secure Boot keys and no iPXE binary — the signed snponly.efi rides the separate
+# fleet-ipxe image (ipxe-image.yaml), mounted into dnsmasq at /ipxe.
+#
+# Runs only when the dnsmasq image inputs change (path filter) or on demand.
+#
+# Required Gitea repo secrets: PACKAGE_USER, PACKAGE_TOKEN (registry creds).
+#
+
+name: Build dnsmasq image
+run-name: ${{ gitea.actor }} builds the serving dnsmasq image
+on:
+  push:
+    branches:
+      - "main"
+    paths:
+      - "serving/dnsmasq/**"
+      - ".gitea/workflows/dnsmasq-image.yaml"
+  workflow_dispatch:
+
+env:
+  DNSMASQ_IMAGE: "git.bitasylum.org/audiobuzz/fleet-dnsmasq"
+
+jobs:
+  dnsmasq-build:
+    name: Build & push dnsmasq image
+    runs-on: ubuntu-latest
+    container:
+      image: git.bitasylum.org/audiobuzz/ubuntu-act-runner-qemu:main
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v6
+
+      -
+        name: Install buildah
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends buildah
+
+      -
+        name: Registry login
+        run: |
+          buildah login \
+            --username "${{ secrets.PACKAGE_USER }}" \
+            --password "${{ secrets.PACKAGE_TOKEN }}" \
+            git.bitasylum.org
+
+      -
+        name: Build & push
+        # vfs storage: overlay-on-overlayfs is unsupported in-container.
+        env:
+          STORAGE_DRIVER: vfs
+          BUILDAH_ISOLATION: chroot
+        run: |
+          SHA="${{ gitea.sha }}"; SHA="${SHA:0:7}"
+          echo "Building ${DNSMASQ_IMAGE}:${SHA} (+ :latest)"
+          buildah bud \
+            -t "${DNSMASQ_IMAGE}:${SHA}" \
+            -t "${DNSMASQ_IMAGE}:latest" \
+            serving/dnsmasq
+          buildah push "${DNSMASQ_IMAGE}:${SHA}"
+          buildah push "${DNSMASQ_IMAGE}:latest"