Local build path: pinned alt-tags, manual-only workflow, README build docs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/build.yml

@@ -2,15 +2,16 @@
 # is a GitHub-context composite and is not supported outside GitHub/GitLab CI.
 # Runner requirement: act_runner must allow privileged job containers
 # (container.privileged: true in the runner's config.yaml) — buildah needs it.
+# NOTE: manual-only for now — no Actions runner is registered on the instance, and the
+# image is currently built/pushed locally (see README "Building locally"). When a runner
+# exists, restore the schedule + push triggers below to make builds fully automatic:
+#   schedule:
+#     - cron: "00 06 * * *"   # daily rebuild pulls in base-image updates
+#   push:
+#     branches: [main]
+#     paths-ignore: ["**.md"]
 name: bluebuild
 on:
-  schedule:
-    - cron: "00 06 * * *" # daily rebuild pulls in base-image updates (self-updating)
-  push:
-    branches:
-      - main
-    paths-ignore:
-      - "**.md"
   workflow_dispatch:
 
 jobs: