ci: build + push the fleet-manager image (join the CI-built serving images)

Add .gitea/workflows/fleet-manager-image.yaml, modelled on dnsmasq-image.yaml:
buildah bud of serving/fleet-manager (multi-stage SPA+Go→distroless) on a
path filter, with the same branch/tag tagging scheme (semver on tags, main-<sha>
+ latest on main, <branch>-<sha> dev images). Wires it into the shared
conventions:
- gitea-main-ci.yaml paths-ignore: list the new workflow so a fleet-manager
  image change doesn't trigger the ~17-min UKI build (serving/** already covers
  the dir; the .gitea/ workflow file needed listing).
- registry-gc.yaml IMAGES: add fleet-manager so its dev-branch builds are GC'd.

.gitea/workflows/fleet-manager-image.yaml

@@ -0,0 +1,111 @@
+#
+# .gitea/workflows/fleet-manager-image.yaml
+#
+# Builds the serving-stack fleet-manager image (serving/fleet-manager) and pushes
+# it to the registry, so mgmt hosts `docker compose pull` it instead of building
+# it at deploy time (matching the dnsmasq / SPDK / kiosk images). The multi-stage
+# Dockerfile builds the Svelte SPA (node) → dist/, compiles the Go binary with the
+# SPA embedded (`-tags embedspa`), and ships FROM distroless static (nonroot). The
+# gRPC .pb.go stubs are committed, so no protoc is needed here.
+#
+# NOTE on base images: the build/ui stages pull the golang + node bases from the
+# harbor mirror; the runtime is gcr.io/distroless/static-debian12:nonroot. The
+# runner needs reach to harbor + gcr.io (mirror distroless through harbor too if
+# egress is restricted).
+#
+# Tagging mirrors gitea-main-ci.yaml so every branch builds a uniquely tagged,
+# pushed image you can test without clobbering main:
+#   - tag push    (refs/tags/v1.2.3) -> "1.2.3"          (+ :latest)
+#   - main push   (refs/heads/main)  -> "main-<sha7>"    (+ :latest)
+#   - branch push (refs/heads/<x>)   -> "<x>-<sha7>"     (dev image, no :latest)
+# Set FLEET_MANAGER_VERSION in serving/fleet-manager/.env to the tag you want to run.
+#
+# Runs only when the fleet-manager image inputs change (path filter) or on demand.
+#
+# Required Gitea repo secrets: PACKAGE_USER, PACKAGE_TOKEN (registry creds).
+#
+
+name: Build fleet-manager image
+run-name: ${{ gitea.actor }} builds the fleet-manager control-plane image (${{ gitea.ref_name }})
+on:
+  push:
+    branches:
+      - "**"      # every branch — dev branches get a branch-name+sha tag
+    tags:
+      - "v*"      # tag push -> clean semver tag (v1.2.3 -> 1.2.3)
+    paths:
+      - "serving/fleet-manager/**"
+      - ".gitea/workflows/fleet-manager-image.yaml"
+  workflow_dispatch:
+
+# One build per ref at a time; a newer push to the same ref cancels the in-flight.
+concurrency:
+  group: fleet-manager-image-${{ gitea.ref }}
+  cancel-in-progress: true
+
+env:
+  FLEET_MANAGER_IMAGE: "git.bitasylum.org/audiobuzz/fleet-manager"
+
+jobs:
+  fleet-manager-build:
+    name: Build & push fleet-manager image
+    runs-on: ubuntu-latest
+    container:
+      image: git.bitasylum.org/audiobuzz/ubuntu-act-runner-qemu:main
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v6
+
+      -
+        name: Derive image tag
+        id: vars
+        # Same scheme as gitea-main-ci.yaml: clean semver on a tag push, else
+        # "<branch>-<sha7>" with the branch sanitized to the OCI tag charset.
+        run: |
+          short_sha="$(echo "${GITHUB_SHA}" | cut -c1-7)"
+          if [ "${GITHUB_REF#refs/tags/}" != "$GITHUB_REF" ]; then
+            version="${GITHUB_REF#refs/tags/}"; version="${version#v}"
+          else
+            branch="${GITHUB_REF#refs/heads/}"
+            safe_branch="$(printf '%s' "$branch" \
+              | sed -e 's#[^A-Za-z0-9._-]#-#g' -e 's#^[.-]*##' | cut -c1-100)"
+            [ -n "$safe_branch" ] || safe_branch="branch"
+            version="${safe_branch}-${short_sha}"
+          fi
+          echo "version=${version}" >> "$GITHUB_OUTPUT"
+          echo "Building ${FLEET_MANAGER_IMAGE}:${version}"
+
+      -
+        name: Install buildah
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends buildah
+
+      -
+        name: Registry login
+        run: |
+          buildah login \
+            --username "${{ secrets.PACKAGE_USER }}" \
+            --password "${{ secrets.PACKAGE_TOKEN }}" \
+            git.bitasylum.org
+
+      -
+        name: Build & push
+        # vfs storage: overlay-on-overlayfs is unsupported in-container.
+        env:
+          STORAGE_DRIVER: vfs
+          BUILDAH_ISOLATION: chroot
+        run: |
+          VER="${{ steps.vars.outputs.version }}"
+          buildah bud -t "${FLEET_MANAGER_IMAGE}:${VER}" serving/fleet-manager
+          buildah push "${FLEET_MANAGER_IMAGE}:${VER}"
+          # Only main / release tags move :latest, so dev branches never clobber it.
+          case "$GITHUB_REF" in
+            refs/heads/main|refs/tags/*)
+              buildah tag  "${FLEET_MANAGER_IMAGE}:${VER}" "${FLEET_MANAGER_IMAGE}:latest"
+              buildah push "${FLEET_MANAGER_IMAGE}:latest"
+              echo "Updated ${FLEET_MANAGER_IMAGE}:latest" ;;
+            *)
+              echo "Dev branch build — :latest left untouched (run with FLEET_MANAGER_VERSION=${VER})" ;;
+          esac

.gitea/workflows/gitea-main-ci.yaml

@@ -58,6 +58,7 @@ on:
       - ".gitea/workflows/ipxe-image.yaml"
       - ".gitea/workflows/dnsmasq-image.yaml"
       - ".gitea/workflows/spdk-image.yaml"
+      - ".gitea/workflows/fleet-manager-image.yaml"
 
 # One build per ref at a time; a newer push to the same branch cancels the
 # in-flight build (each build is a ~17-min VM run, so don't stack them).

.gitea/workflows/registry-gc.yaml

@@ -64,7 +64,7 @@ jobs:
       DISPATCH_DRY: ${{ inputs.dry_run }}
       GC_ENABLE: ${{ vars.REGISTRY_GC_ENABLE }}
       # Only images built by THIS repo's workflows.
-      IMAGES: "fleet-boot fleet-ipxe fleet-dnsmasq spdk-nvmf"
+      IMAGES: "fleet-boot fleet-ipxe fleet-dnsmasq spdk-nvmf fleet-manager"
     steps:
       - name: Reconcile registry against live branches
         # The runner defaults `run:` to sh (dash); this script uses bashisms