ci: run tests in the default node image (Debian python3) and build the image via buildx like qr

.gitea/workflows/ci.yml

@@ -1,5 +1,8 @@
 # Gitea CI for the OTM fork: the unit + Flask tests, then prove the image builds.
 # Upstream's .github/workflows/build.yaml pushed to GHCR and could never pass here.
+# Jobs run in the runner's default node:22-bookworm container (actions/checkout
+# needs node), so Python comes from Debian; the image job mirrors qr's (buildx,
+# push: false) — that shape is proven on both runners.
 name: CI
 on:
   push:
@@ -7,13 +10,22 @@ on:
 jobs:
   test:
     runs-on: ubuntu-latest
-    container: python:3.13-slim
     steps:
       - uses: actions/checkout@v4
-      - run: pip install -q -r requirements.txt
-      - run: cd app && python -m unittest -v
+      - name: Python + deps
+        run: |
+          apt-get update -qq && apt-get install -y -qq python3 python3-pip > /dev/null
+          pip3 install -q --break-system-packages -r requirements.txt
+      - run: cd app && python3 -m unittest -v
   image:
     runs-on: ubuntu-latest
+    needs: test
     steps:
       - uses: actions/checkout@v4
-      - run: docker build -t 13ft-ci:${{ gitea.sha }} .
+      - uses: docker/setup-buildx-action@v3
+      - name: Build image (verification only)
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          tags: 13ft:ci