A buildkit FROM does its own pull and ignores the nodes' containerd mirror, so
every build was an uncached, rate-limited Docker Hub pull.
- point BASE_IMAGE at dockerhub/library/almalinux:9
- drop the syntax directive, which pulled a frontend image from Docker Hub for
features this Dockerfile does not use
Replace the packer-images almalinux base with a Dockerfile matrix over distros/,
publishing one image per distro to docker-internal on a single repo semver.
- bootstrap the internal CA from a sha256-pinned rpm fetched over plain HTTP
- install the estate dnf repo configuration pointed at artifactapi
- run in-image assertions as a --target test build stage
- add pull_request build/test/pre-commit and tag-triggered docker workflows
unkin-agent