ci: gate the image build on vet/build/test, push sha tags, protect latest

- check job runs go vet, go build and go test -short before the build
- images are pushed as :<tag> and :sha-<12>; :latest moves only on tag pushes
- GIT_COMMIT build arg and OCI source/created labels

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/plans-executions/2026-10-08-2028-house-conventions.md

@@ -8,7 +8,7 @@ Plan: `docs/plans/2026-10-08-2028-house-conventions.md`
 - [x] Step 3 — Makefile, lint, formatting
 - [x] Step 4 — Module path and version identity
 - [x] Step 5 — Baseline tests
-- [ ] Step 6 — CI build workflow
+- [x] Step 6 — CI build workflow
 - [ ] Step 7 — Close out
 
 ## Step 1 — CLAUDE.md
@@ -130,3 +130,14 @@ truncation are deliberately not asserted, so the suite does not pin behaviour th
 the bug-fix phase will change. `TestListenersEqual_managedFields` only asserts the
 four fields the comparison covers today; it says nothing about protocol, allowed
 routes or TLS mode.
+
+## Step 6 — CI build workflow
+
+`.gitea/workflows/build.yaml` is now a verbatim copy of the egress workflow; it has
+no project-specific strings (the image name comes from `github.repository`).
+
+Worth noting: not run yet. The first tag push or manual dispatch is the test. Two
+things could differ from egress on this repo's runner: `actions/setup-go@v5` (uh-cli
+had to install Go with curl instead), and lint is not part of the `check` job, same
+as egress. The unused `GIT_TAG` and `BUILD_DATE` build args are gone;
+`kubernetes-deploy.yaml` is untouched.