feat(images): build on rootless BuildKit over mTLS; verification moves into Containerfile verify stages

Operator decision on PR #81: no CI job may reach a privileged daemon. The act runner is untouched.

- platform/buildkit (+ clusters/base/buildkit.yaml): moby/buildkit v0.34.1-rootless pinned by
  digest, uid 1000, not privileged; caps drop ALL + SETUID/SETGID, seccomp/AppArmor Unconfined,
  read-only rootfs (each measured under podman). cert-manager CA + server/client certs, ClusterIP
  :1234, default-deny with ingress only from the act-runner pod (DinD masquerades jobs to it).
  No Kyverno exception: every applied policy matches app-namespace=true only.
- Each Containerfile names its shipped stage and ends in a `verify` stage holding every former
  `docker run` assertion (uid 65532, RUN --network=none, writable-path inventory standing in for
  the read-only rootfs). The old `&& echo` checks that could never fail are real assertions now.
- images.sh drives buildkitd with a pinned buildx (sha256-checked) via bake; PRs build verify
  targets with agent-runner FROM the in-run toolbox (target: context); main verifies, then pushes.
  Fails loudly when the builder secrets are absent or buildkitd is unreachable.
- infra/gitea/buildkit-client-secret.sh copies the client cert into Actions secrets.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

platform/buildkit/namespace.yaml

@@ -0,0 +1,26 @@
+---
+# buildkit — the image builder for CI (.gitea/workflows/images.yaml). Operator decision on PR #81
+# (2026-10-29): images are built by a ROOTLESS BuildKit daemon reached over mTLS, and NO CI job
+# may reach a privileged daemon. See README.md for the whole design.
+#
+# A NAMESPACE OF ITS OWN, deliberately NOT `gitea-actions`:
+#   * The act-runner namespace exists to hold a PRIVILEGED DinD sidecar. Putting the builder
+#     beside it would put a TLS server key next to a privileged container for no benefit.
+#   * Its NetworkPolicies, Secrets and quota then belong to one component, and the ingress rule
+#     ("only the act-runner pod may connect") can be written from the outside.
+#
+# NO `app-namespace` LABEL, like gitea-actions: this is CI plumbing, not a user-facing app. That
+# is also why NO Kyverno exception is needed — every applied ClusterPolicy
+# (platform-config/kustomization.yaml) matches only namespaces labelled
+# homelab.keithjackson.dev/app-namespace: "true", and none of the job-shape policies match here.
+#
+# NO pod-security.kubernetes.io LABEL, on purpose. Rootless BuildKit needs seccomp AND AppArmor
+# `Unconfined` (measured — see deployment.yaml), which PSS `baseline` forbids; there is no
+# cluster-wide PSA default here, so an unlabelled namespace admits it. It is NOT privileged and
+# the deployment's securityContext is the boundary — read it before relaxing anything.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: buildkit
+  labels:
+    homelab.keithjackson.dev/ci: buildkit