[chore](trx-rs): shared SDK image for CI and developers

Rework container/ from a host-executor act_runner image into a single
"SDK" build image used everywhere: as the CI job container (Docker
executor) and by developers locally / via .devcontainer. It bakes in a
pinned Rust toolchain and all build dependencies, so CI and every
developer share the exact same rustc/clippy.

- container/Containerfile: SDK image (Debian + deps + pinned Rust + Node).
- rust-toolchain.toml: pin the toolchain to match the image; also ends the
  "CI clippy newer than local" version skew.
- .gitea/workflows/ci.yml: lint/test run inside the SDK image via
  `container:`; reuse returns to fsfe/reuse-action (Docker executor runs
  it as a sibling container, so nothing REUSE-related is baked in).
- .devcontainer/devcontainer.json: dev use of the same image.
- container/runner-config.example.yaml: Docker-executor runner config for
  the CI VM, capped for a 2-thread budget.
- Drop the obsolete host-executor entrypoint/config/Quadlet units.

Assisted-By: Claude Code (claude-opus-4)
Claude-Session: https://claude.ai/code/session_01NFpGtGTWUEYXLwZeZs2RAV
Signed-off-by: Stan Grams <sjg@haxx.space>

.gitea/workflows/ci.yml

@@ -2,10 +2,10 @@
 #
 # SPDX-License-Identifier: GPL-2.0-or-later
 
-# CI for the self-hosted, host-executor Podman runners (see container/).
-# The runner image bakes in the Rust toolchain and all build dependencies,
-# so jobs go straight to cargo — no apt/rustup setup steps (which also
-# collided on the dpkg lock when jobs ran concurrently in the same runner).
+# CI for the Docker-executor runner (VM). The lint/test jobs run inside the
+# shared trx-rs SDK image (container/Containerfile), which bakes in the pinned
+# Rust toolchain and all build dependencies. The reuse job uses the upstream
+# Docker action, which the Docker executor launches as a sibling container.
 
 name: CI
 
@@ -20,6 +20,7 @@ env:
 jobs:
   lint:
     runs-on: ubuntu-latest
+    container: git.haxx.space/sjg/trx-rs-sdk:latest
     steps:
       - uses: actions/checkout@v4
       - name: rustfmt
@@ -29,6 +30,7 @@ jobs:
 
   test:
     runs-on: ubuntu-latest
+    container: git.haxx.space/sjg/trx-rs-sdk:latest
     steps:
       - uses: actions/checkout@v4
       - name: Build
@@ -40,8 +42,4 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - name: REUSE compliance
-        # `reuse` CLI instead of fsfe/reuse-action: the latter is a Docker
-        # action, which the host-executor runners cannot run. `reuse` is baked
-        # into the runner image (see container/Containerfile).
-        run: reuse lint
+      - uses: fsfe/reuse-action@v5