Add a Docker-based build image and wire it into CI for the watch app

CLAUDE.md

@@ -106,19 +106,47 @@ from the org/instance level).
 
 ### Watch app packaging (`make watchapp`)
 
-A separate target, deliberately **not** a prerequisite of `all` and
-**not** run by CI - it shells out to `pebble build` inside `watch/`
-(via `watch/wscript`'s own Pebble SDK/waf tooling, not this Makefile's
-plain-`cc` rules) and copies the resulting `watch/build/watch.pbw` to
+A separate target, deliberately **not** a prerequisite of `all` - it
+shells out to `pebble build` inside `watch/` (via `watch/wscript`'s own
+Pebble SDK/waf tooling, not this Makefile's plain-`cc` rules) and copies
+the resulting `watch/build/watch.pbw` to
 `dist/deck-in-a-dash-<version>.pbw`, using the exact same version
 resolution as `make package` above (current git tag, or `make watchapp
 VERSION=1.2.3` to override - see that section, not duplicated here).
 Requires the Pebble SDK (`pebble` on `PATH`, plus the Python 3 + Pillow
 `watch/wscript` needs for its resource-generation scripts) - a machine
 without it can still build/test/package the CLI via every other target
-in this file. Not wired into `.gitea/workflows/build.yml`: doing so
-would need the Pebble SDK toolchain installed on the CI runner, which
-this project doesn't currently provision.
+in this file.
+
+`.gitea/workflows/build.yml` **does** run `make watchapp` on every
+push/PR, alongside `make test`/`make package` - the whole job runs
+inside a container image (`build-image/`, built and pushed with
+`build-image.sh`/`upload-image.sh`, see "Build image" below) that has
+the Pebble SDK baked in, so the CI runner itself needs no toolchain
+beyond Docker access to pull that image. Both the CLI tarball and the
+`.pbw` are uploaded as build artifacts and published to
+`dl.ladkau.de/files/deck-in-a-dash/` on push.
+
+### Build image
+
+`build-image/Dockerfile` pins the exact toolchain versions (Pebble
+Tool, Pebble SDK core, Node.js) needed for `make test`, `make package`,
+and `make watchapp`, so builds are reproducible independent of whatever
+happens to be installed on a given machine. Three root-level scripts
+drive it, each reading registry settings from a gitignored
+`registry.env` (copy `registry.env.example` to create it - never commit
+the real file, since it holds registry credentials) and the image tag
+from `build-image/VERSION`:
+
+- `build-image.sh` - builds and locally tags the image (`:VERSION` and
+  `:latest`), no push.
+- `run-image.sh [VERSION]` - runs `make test package watchapp` inside
+  the locally-built image against a live bind-mount of the repo, wiping
+  generated build artifacts first for CI parity. Use this to validate a
+  `build-image/Dockerfile` change before pushing the image anywhere.
+- `upload-image.sh` - logs in and pushes the image (`:VERSION` and
+  `:latest`) to the registry; `.gitea/workflows/build.yml` pulls
+  `:latest` to run its build job (see "Watch app packaging" above).
 
 ## Architecture