Rebuild on kernel changes and on age, not just on pve-manager

The build condition only compared pve-manager, which left two gaps. Kernel
security fixes ship in proxmox-default-kernel and do not bump pve-manager, so the
updates that matter most would not have triggered a rebuild. Debian base security
updates bump neither, so an image could have sat unchanged indefinitely while its
openssl and glibc went stale.

scripts/ci/decide-build.sh now rebuilds when pve-manager changes, when
proxmox-default-kernel changes, or when the newest release passes MAX_AGE_DAYS
(30). It compares against image-info.txt from the last release rather than
inferring from tag names, so the comparison reflects what is actually inside the
published image, and it can be run by hand to see the decision without triggering
anything.

The daily schedule stays. Measured from the trixie repository, Proxmox publishes
about weekly — 56 pve-manager and 28 proxmox-kernel versions since 9.0 — so daily
checking costs about 30 seconds on the days nothing changed and cuts worst-case
staleness from a week to a day. Tags carry the date now (pve-<version>-<date>)
because an age-triggered rebuild can repeat a version.

The README gains a "Prebuilt images" section linking the releases page, with the
checksum and MAAS upload commands, and a "Release automation" section explaining
the trigger table and stating plainly that the host-mode runner gives root on the
build machine to anything that can dispatch a workflow.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitea/workflows/build-image.yml

@@ -37,6 +37,9 @@ jobs:
       GITEA_API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
       GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
       KEEP_RELEASES: '3'
+      # Rebuild even without a Proxmox version change once an image reaches this
+      # age, so Debian base security updates make it into the image.
+      MAX_AGE_DAYS: '30'
 
     steps:
       - name: Check out
@@ -58,29 +61,12 @@ jobs:
         run: |
           set -eu
           cd "$GITHUB_WORKSPACE"
-
-          UPSTREAM=$(./scripts/ci/upstream-version.sh)
-          TAG="pve-${UPSTREAM}"
-          echo "upstream pve-manager: ${UPSTREAM}"
-
-          PUBLISHED=$(curl -fsS -H "Authorization: token ${GITEA_TOKEN}" \
-              "${GITEA_API}/releases?limit=1" \
-            | python3 -c 'import json,sys; r=json.load(sys.stdin); print(r[0]["tag_name"] if r else "")')
-          echo "latest release: ${PUBLISHED:-<none>}"
-
-          echo "tag=${TAG}"          >> "$GITHUB_OUTPUT"
-          echo "version=${UPSTREAM}" >> "$GITHUB_OUTPUT"
-
+          ./scripts/ci/decide-build.sh "$MAX_AGE_DAYS" > "$GITHUB_OUTPUT"
           if [ "${{ inputs.force }}" = "true" ]; then
             echo "forced by manual trigger"
-            echo "build=yes" >> "$GITHUB_OUTPUT"
-          elif [ "$PUBLISHED" = "$TAG" ]; then
-            echo "${TAG} is already published — nothing to do"
-            echo "build=no" >> "$GITHUB_OUTPUT"
-          else
-            echo "new version — building"
-            echo "build=yes" >> "$GITHUB_OUTPUT"
+            sed -i 's/^build=no$/build=yes/' "$GITHUB_OUTPUT"
           fi
+          cat "$GITHUB_OUTPUT"
 
       - name: Build
         if: steps.decide.outputs.build == 'yes'