Build every artifact in a pinned image, not on my laptop

Two builder images, because the jobs genuinely need two distributions:
Ubuntu for the tests, the Linux bundle and the Android APK, and Arch for
the .pkg.tar.zst, since makepkg is Arch-specific. Both are built from
this repo (NFR-12) and pinned by tag in the workflows, so a Dockerfile
change only reaches CI once it has been pushed.

libdbus-1-dev is not incidental in the Ubuntu image: btleplug's Linux
backend is bluez-async over the dbus crate, so without it the workspace
does not build at all.

The per-commit Android job is a cargo check, not an APK. The full signed
build is ~15 minutes and runs only on tags; a one-minute check catches
what actually breaks — the JNI shim, droidplug, and any desktop-only API
that has crept into a shared crate.

Two invariants a compiler cannot see are checked there too, because both
fail silently: the app builds, installs, launches, and finds no trainer.
The JNI symbol in android.rs is matched by the runtime by name, so
renaming the Kotlin package compiles fine and simply never initialises
btleplug; and gen/ must stay untracked or the sync script quietly becomes
optional.

The Android versionCode carries a 1000 floor. `tauri android init` writes
1000 for 0.1.0 today, so anyone holding a locally built APK already has
that number installed, and a bare major/minor/patch code would be 100 —
a downgrade, which Android refuses outright.

The fmt check is advisory for now. The tree predates this workflow and
`cargo fmt --all` currently rewrites ~2000 lines across 28 files; making
it a gate here would mean landing a repo-wide reformat as a side effect
of adding CI. Run fmt in its own commit, then drop the continue-on-error.
The two clippy warnings that stood between the tree and a real
`-D warnings` gate are fixed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/build-builder-image.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# Build (and optionally push) the CI builder images.
+#
+#   scripts/build-builder-image.sh                 # build both, no push
+#   scripts/build-builder-image.sh --push          # build both and push
+#   scripts/build-builder-image.sh --only arch     # just the Arch image
+#   scripts/build-builder-image.sh --only main     # just the Ubuntu image
+#
+# Two images, because the jobs genuinely need different distributions:
+#   main — Ubuntu: tests, Linux desktop bundle, Android APK (Dockerfile.builder)
+#   arch — Arch:   the .pkg.tar.zst, which needs makepkg (Dockerfile.arch)
+#
+# The workflows in .gitea/workflows pin these by tag, so a change to either
+# Dockerfile only reaches CI once this has run with --push.
+set -euo pipefail
+
+REGISTRY="${REGISTRY:-gitea.tourolle.paris}"
+NAMESPACE="${NAMESPACE:-$REGISTRY/dtourolle}"
+TAG="${TAG:-latest}"
+
+PUSH=0
+ONLY=both
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --push) PUSH=1 ;;
+    --only) shift; ONLY="${1:-}" ;;
+    -h|--help) sed -n '2,16p' "${BASH_SOURCE[0]}"; exit 0 ;;
+    *) echo "❌ Unknown option: $1 (try --help)" >&2; exit 2 ;;
+  esac
+  shift
+done
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+build_one() {
+  local dockerfile="$1" image="$NAMESPACE/$2:$TAG"
+  echo "🐳 Building $image from $dockerfile"
+  docker build -f "$dockerfile" -t "$image" .
+  if [ "$PUSH" = 1 ]; then
+    echo "⬆️  Pushing $image"
+    docker push "$image"
+  fi
+}
+
+case "$ONLY" in
+  main) build_one Dockerfile.builder bikecontrol-builder ;;
+  arch) build_one Dockerfile.arch bikecontrol-arch-builder ;;
+  both)
+    build_one Dockerfile.builder bikecontrol-builder
+    build_one Dockerfile.arch bikecontrol-arch-builder
+    ;;
+  *) echo "❌ --only takes main, arch or both" >&2; exit 2 ;;
+esac
+
+[ "$PUSH" = 1 ] || echo "ℹ️  Not pushed. Re-run with --push when you are happy with it."