ci: build weave-kube and weave-npc, push to this Gitea's registry

A Gitea Actions workflow that builds the two images the cluster runs from
reweave/build/Dockerfile (linux/amd64 only) and pushes them to
git.levk.dev/reweave/{weave-kube,weave-npc}, tagged with the full commit
SHA so a tag never changes meaning. It stops at the push; rollout is the
CD side's job. Build-time fetches (base images, apt/apk, Go modules) stay
external for now and are to be peeled out once self-deploy works.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UHXzGrsxfkGk8LmwrBbHNZ

.gitea/workflows/images.yml

@@ -0,0 +1,54 @@
+# Build the images the cluster runs (weave-kube, weave-npc) and push them to
+# this Gitea's container registry. CI stops here: rolling them out is the
+# CD side's job, not this workflow's.
+#
+# Tags are the full commit SHA, so a tag never moves: rebuilding a commit
+# pushes the same name again instead of changing what an existing name means.
+# linux/amd64 only for now (every node is amd64).
+name: images
+
+on:
+  push:
+    paths-ignore:
+      - "website/**"
+      - "docs/**"
+      - "**.md"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  images:
+    runs-on: ubuntu-latest
+    env:
+      REGISTRY: git.levk.dev
+      IMAGE_PREFIX: git.levk.dev/reweave
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0 # tags, for the version string
+
+      - name: Log in to the registry
+        run: echo "${{ secrets.GITEA_TOKEN }}" | docker login "$REGISTRY" -u "${{ gitea.actor }}" --password-stdin
+
+      - name: Build and push (linux/amd64)
+        run: |
+          set -eu
+          sha=$(git rev-parse HEAD)
+          version=$(git describe --tags --always | sed 's/^v//')
+          for pair in weavekubeimage:weave-kube weavenpcimage:weave-npc; do
+            target=${pair%%:*}
+            image="$IMAGE_PREFIX/${pair#*:}:$sha"
+            docker buildx build --push --progress=plain \
+              --platform=linux/amd64 \
+              --target="$target" \
+              --build-arg=WEAVE_VERSION="$version" \
+              --build-arg=revision="$sha" \
+              --build-arg=imageversion="$version" \
+              -f reweave/build/Dockerfile \
+              -t "$image" \
+              .
+            echo "pushed $image"
+          done