Add a Docker-based build image and wire it into CI for the watch app

build-image/Dockerfile

@@ -0,0 +1,49 @@
+# Build environment for deck_in_a_dash release artifacts: a plain C
+# toolchain for the desktop deck-engine/interpreter-cli binaries (`make
+# test`, `make package`) plus the Pebble SDK for the watch app (`make
+# watchapp`), pinned to the versions validated on the maintainer's dev
+# machine. Rebuild with ../build-image.sh whenever a version below
+# changes.
+#
+# Does NOT contain any secrets - registry/SFTP credentials are injected
+# at job runtime from Gitea Actions secrets, never baked into this image.
+FROM ubuntu:22.04
+
+ARG PEBBLE_TOOL_VERSION=5.0.39
+ARG PEBBLE_SDK_CORE_VERSION=4.17
+ARG NODE_VERSION=24.16.0
+
+ENV DEBIAN_FRONTEND=noninteractive \
+    PATH=/root/.local/bin:${PATH}
+
+# build-essential: gcc/make for the desktop deck-engine/interpreter-cli
+# binaries (`make test`, `make package`).
+# python3/python3-venv/python3-pip: `pebble sdk install` below creates a
+# venv per SDK version; Pillow (installed below) is needed at `pebble
+# build` time by watch/scripts/gen_card_images.py and gen_app_icon.py.
+# git/curl/ca-certificates/unzip/tar/xz-utils: checkout, tool downloads,
+# and `make package`/`make watchapp`'s `git describe --tags` versioning.
+# openssh-client: the build workflow's `sftp` publish to dl.ladkau.de.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        build-essential python3 python3-venv python3-pip \
+        git curl ca-certificates unzip tar xz-utils openssh-client \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN pip3 install --no-cache-dir Pillow
+
+# Node.js: `pebble sdk install` below runs `npm install` for the SDK
+# core's bundled webpack tooling - it does not bring its own node/npm.
+RUN curl -sSL -o /tmp/node.tar.xz \
+        "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz" \
+    && tar -xJf /tmp/node.tar.xz -C /usr/local --strip-components=1 \
+    && rm /tmp/node.tar.xz
+
+# Pebble SDK: pebble-tool (via uv, pipx-style isolated install) + the
+# sdk-core toolchain/webpack deps for PEBBLE_SDK_CORE_VERSION, both
+# fully resolved here so no `docker run` of this image needs network
+# access to install anything before `pebble build` works.
+RUN curl -LsSf https://astral.sh/uv/install.sh | sh \
+    && uv tool install "pebble-tool==${PEBBLE_TOOL_VERSION}" \
+    && pebble sdk install "${PEBBLE_SDK_CORE_VERSION}"
+
+WORKDIR /workspace