Make OpenCode image builds production-ready

[Llewellynvdm]

What changed

• separates GitHub Actions and Gitea Actions so provider-specific contexts are valid
• runs repository validation on a GitHub-hosted runner and gates image construction on an Incus/KVM preflight
• uploads downloadable GitHub workflow artifacts and preserves Gitea Generic Package publication
• pins OpenCode, Git MCP, Playwright, TypeScript, Ruff, mypy, and GitHub Actions
• preinstalls Git MCP and preserves the Playwright browser outside cleaned cache paths
• adds checksummed package manifests, safe image import, and a package round-trip test
• removes third-party Joomla MCP references and removes premature Joomla/JCB runtime entries
• keeps only the future VDM Joomla MCP repository and the future JCB integration gate
• documents the controlled GitHub-to-Gitea migration and one-way mirroring model

Root causes fixed

The initial GitHub workflow used the Gitea-only gitea.ref expression, so GitHub rejected the workflow definition. The repository YAML also contained trailing blank lines rejected by its own yamllint policy. Additional build-path issues included an unused .env, floating runtime installs, and PHP images claiming browser support without provisioning Playwright.

Validation

• repository validation script
• ShellCheck 0.11.0
• yamllint 1.37.1 using the repository policy
• JSON and YAML parse checks
• mocked package/checksum/Incus-import round trip

Remaining deployment gate

The real six-variant Incus build requires a trusted self-hosted Ubuntu runner with /dev/kvm, an Incus storage pool, at least 220 GiB free, and the configured runner label. The PR remains draft until that hardware build is run and one exported package is imported on a clean Incus host.