[chore](trx-rs): shared SDK image for CI and developers

Rework container/ from a host-executor act_runner image into a single
"SDK" build image used everywhere: as the CI job container (Docker
executor) and by developers locally / via .devcontainer. It bakes in a
pinned Rust toolchain and all build dependencies, so CI and every
developer share the exact same rustc/clippy.

- container/Containerfile: SDK image (Debian + deps + pinned Rust + Node).
- rust-toolchain.toml: pin the toolchain to match the image; also ends the
  "CI clippy newer than local" version skew.
- .gitea/workflows/ci.yml: lint/test run inside the SDK image via
  `container:`; reuse returns to fsfe/reuse-action (Docker executor runs
  it as a sibling container, so nothing REUSE-related is baked in).
- .devcontainer/devcontainer.json: dev use of the same image.
- container/runner-config.example.yaml: Docker-executor runner config for
  the CI VM, capped for a 2-thread budget.
- Drop the obsolete host-executor entrypoint/config/Quadlet units.

Assisted-By: Claude Code (claude-opus-4)
Claude-Session: https://claude.ai/code/session_01NFpGtGTWUEYXLwZeZs2RAV
Signed-off-by: Stan Grams <sjg@haxx.space>

container/Containerfile

@@ -2,60 +2,45 @@
 #
 # SPDX-License-Identifier: GPL-2.0-or-later
 
-# Gitea Actions runner image for trx-rs CI (host-executor / "Pattern B").
+# trx-rs SDK / build image.
 #
-# All build dependencies, the Rust toolchain, Node.js (for JS actions such as
-# actions/checkout and actions/cache) and the `reuse` tool are baked in, so CI
-# runs skip the per-run apt/rustup install cost. `sudo` is present so the
-# existing workflow's `sudo apt-get ...` / rustup steps remain valid — they
-# just become fast no-ops because everything is already installed.
+# Single source of truth for the build environment. Used two ways:
+#   * CI  — as the job container for the lint/test jobs (Docker executor).
+#   * Dev — run locally or via .devcontainer for a reproducible toolchain.
+#
+# Pinning the Rust version here (and in rust-toolchain.toml) means CI and every
+# developer share the exact same rustc/clippy, so "works locally, fails in CI"
+# cannot happen.
 FROM docker.io/library/debian:bookworm-slim
 
-ARG ACT_RUNNER_VERSION=0.2.11
+# Keep in sync with rust-toolchain.toml.
+ARG RUST_VERSION=1.97.1
 ARG NODE_MAJOR=20
 
 ENV DEBIAN_FRONTEND=noninteractive \
-    RUSTUP_HOME=/opt/rustup \
-    CARGO_HOME=/opt/cargo \
-    PATH=/opt/cargo/bin:/usr/local/bin:/usr/bin:/bin
+    RUSTUP_HOME=/usr/local/rustup \
+    CARGO_HOME=/usr/local/cargo \
+    PATH=/usr/local/cargo/bin:/usr/local/bin:/usr/bin:/bin
 
-# Base tooling + trx-rs build dependencies (mirrors .gitea/workflows/ci.yml).
+# Build dependencies (mirror README's manual instructions).
 RUN apt-get update && apt-get install -y --no-install-recommends \
-        ca-certificates curl xz-utils git sudo pipx \
+        ca-certificates curl git \
         build-essential pkg-config cmake clang libclang-dev \
         libopus-dev libasound2-dev libsoapysdr-dev \
     && rm -rf /var/lib/apt/lists/*
 
-# Node.js (JS-based actions need node in PATH under the host executor).
+# Node.js — JS-based actions (actions/checkout, actions/cache) run *inside*
+# the job container under the Docker executor, so node must be present.
 RUN curl -fsSL https://deb.nodesource.com/setup_${NODE_MAJOR}.x | bash - \
     && apt-get install -y --no-install-recommends nodejs \
     && rm -rf /var/lib/apt/lists/*
 
-# REUSE >= 3 (Debian's packaged reuse is too old for REUSE.toml).
-# The [charset-normalizer] extra provides an encoding-detection backend;
-# without it (and without libmagic) reuse fails to import at runtime.
-RUN PIPX_HOME=/opt/pipx PIPX_BIN_DIR=/usr/local/bin pipx install 'reuse[charset-normalizer]'
-
-# Rust stable with rustfmt + clippy, installed system-wide.
+# Pinned Rust toolchain, installed world-readable so any UID the runner or a
+# devcontainer uses can invoke cargo.
 RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
-        | sh -s -- -y --no-modify-path --profile minimal \
-          --component rustfmt --component clippy \
-    && chmod -R a+rwX "$CARGO_HOME" "$RUSTUP_HOME"
+      | sh -s -- -y --no-modify-path \
+        --default-toolchain "${RUST_VERSION}" --profile minimal \
+        --component rustfmt --component clippy \
+    && chmod -R a+rwX "$RUSTUP_HOME" "$CARGO_HOME"
 
-# act_runner binary.
-RUN arch="$(dpkg --print-architecture)"; \
-    case "$arch" in amd64) rarch=amd64;; arm64) rarch=arm64;; *) echo "unsupported arch $arch" >&2; exit 1;; esac; \
-    curl -fsSL -o /usr/local/bin/act_runner \
-      "https://gitea.com/gitea/act_runner/releases/download/v${ACT_RUNNER_VERSION}/act_runner-${ACT_RUNNER_VERSION}-linux-${rarch}" \
-    && chmod +x /usr/local/bin/act_runner
-
-# Default config template (seeded into the /data volume on first boot).
-COPY config.yaml /etc/act_runner/config.yaml
-COPY entrypoint.sh /usr/local/bin/entrypoint.sh
-RUN chmod +x /usr/local/bin/entrypoint.sh
-
-# /data holds the .runner registration, cache and workflow workspaces.
-VOLUME /data
-WORKDIR /data
-
-ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
+WORKDIR /work