Run CI and release jobs inside the prebuilt CI images

Replaces setup-php with `container:` in every job that needs PHP. The images
published by ci-images.yml already carry PHP, Composer, the intl and zip
extensions and the CLI tools the workflow scripts shell out to, so nothing
installs PHP at job time any more.

That removes the apt path #178 was about: a ~145s floor on 8.3 against ~35s
on 8.1/8.2, with a tail that twice ran past the step timeout and failed the
run. All three copies of the `Keep downloaded .debs` / `Cache apt packages`
workaround go with it.

no-debug and bump-version stay on the runner image — neither needs PHP, and
no-debug wants the runner's GNU `grep --include`.

The Composer cache moves to /composer/cache, which is COMPOSER_HOME in the
image, and release.yml gains the cache step it never had.

Also corrects the image size in docs/ci.md to the 67MB measured from the
published manifest; the ~120MB in the original was an estimate.

Closes #187

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01D9acV1mHktGAb1uyvNmrR2

.gitea/workflows/release.yml

@@ -15,15 +15,14 @@ jobs:
   release:
     name: Build and Publish Release
     runs-on: ubuntu-latest
+    # Runs in the prebuilt CI image rather than installing PHP — see
+    # docs/ci.md and #187. The image carries composer, jq, curl and GNU
+    # coreutils, which is everything the steps below shell out to.
+    container:
+      image: git.unsupervised.ca/unsupervised/ci-php:8.3
     steps:
       - uses: actions/checkout@v4
 
-      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: '8.3'
-          tools: composer:v2
-
       # A tag that disagrees with the plugin header would make sites see a
       # phantom update forever (or never see a real one), so fail fast.
       - name: Verify tag matches plugin version
@@ -37,6 +36,13 @@ jobs:
           fi
           echo "version=${header_version}" >> "$GITHUB_OUTPUT"
 
+      # COMPOSER_HOME is /composer in the CI image.
+      - name: Cache Composer packages
+        uses: actions/cache@v4
+        with:
+          path: /composer/cache
+          key: composer-${{ hashFiles('composer.json') }}
+
       - name: Install dependencies
         run: composer install --prefer-dist --no-progress --no-interaction