ci: cut PR CI time with a prebuilt image, ccache, and no QML cachegen (#22)

CI took about 5 min 10 s per PR on vm-201: 1.5 min of `pacman -Syu` and 3.5 min of build, half of it qmlcachegen compiling QML the tests never load. Now it takes **1 min 49 s with a cold ccache and 26 s with a warm one**.

- CI runs in a prebuilt Arch image with the build deps (`git.trivk.dev/tri/qtpotato-ci:latest`). `ci-image.yml` rebuilds it weekly, when its Dockerfile changes, or on demand. It builds on the runner's own Docker daemon, so vm-201 has the new image right away, since the runner does not re-pull tags it already has.
- CI configures with `QT_QML_NO_CACHEGEN=ON` and no debug info. Release and AUR builds keep both.
- ccache, kept between runs with `actions/cache`.
- Docs-only changes (`README.md`, `LICENSES/`) skip CI.

Pushing the image to the registry needed two workarounds. Gitea's Actions token cannot push container images, so it uses the `PACKAGE_TOKEN` secret from #21. Cloudflare rejects request bodies over 100 MB and `docker push` sends each layer in one request, so `regctl` (pinned by sha256) pushes the layers in 50 MB chunks.

Giving vm-201 more vCPUs is left out; it is an infra change.

Refs #20

Proof: on this PR, CI run 328 (cold ccache) took 1 min 49 s and run 332 (warm, 41/44 hits) took 26 s, both 8/8 tests. Image run 333 pushed the image, and the registry digest matches the runner's local image. A local build with the CI flags takes 74 steps instead of 154.

Reviewed with sol-loop: 3 rounds with gpt-6.1-sol. Sol verdict: approved

Created with Claude Opus 5.5 in Claude Code (T3 Code).
Reviewed-on: #22
Co-authored-by: Tri Vo Khac <git@trivk.dev>

.gitea/workflows/arch-package.yml

@@ -13,7 +13,6 @@ on:
 
 permissions:
   contents: read
-  packages: write
 
 jobs:
   package:
@@ -49,7 +48,9 @@ jobs:
           su builder -c "cd $dir && makepkg --noconfirm"
       - name: Publish
         env:
-          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # The package registry rejects the job token, so this is a personal access token
+          # with the write:package scope.
+          TOKEN: ${{ secrets.PACKAGE_TOKEN }}
         run: |
           for f in /tmp/pkg/qtpotato-[0-9]*.pkg.tar.zst; do
               curl -fsS -X PUT -H "Authorization: token $TOKEN" --upload-file "$f" \

README.md

@@ -46,7 +46,7 @@ Server = https://git.trivk.dev/api/packages/tri/arch/$repo/$arch
 ```
 
 ```sh
-sudo pacman -Sy qtpotato
+sudo pacman -Syu qtpotato
 ```
 
 The package is built against Arch's current Qt and KDE Frameworks. If it breaks after a system