Producer half of the Woodpecker CI cache work (#634). Adds Dockerfile.ci
and .woodpecker/ci-image.yml only — nothing in this PR references the
ci-base image yet, so its own CI runs on the existing node:22-alpine and
stays green.
Review fixes applied:
- N2: bake `bash` into the apk toolchain (ci.yml's sanitization step
otherwise does a per-run `apk add bash`).
- N1: correct the Dockerfile comments — `pnpm fetch` only populates the
tarball store; native node-gyp modules still compile at `pnpm install`,
which is why the musl toolchain stays baked.
After merge, ci-base:latest is primed via a manual `ci-image` pipeline
trigger on main; the consumer PR (#635) then switches ci.yml/publish.yml
to pull it.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
