Split the monolithic build-image.sh into three scripts: build-image.sh now only builds locally, run-image.sh

runs dist.sh inside that local image via a bind mount, andcupload-image.sh pushes the already-built image.
The Dockerfile also warms the Gradle dependency cache in a throwaway build stage, and pre-installs
the pinned CMake version, so `run-image.sh` doesn't re-download the same Maven dependencies on every run.

dist.sh now strips the -pre+meta suffix before writing package.json's version, since Pebble's build
tooling parses it strictly as X.Y.Z integers and was rejecting suffixed versions.

README.md

@@ -150,8 +150,10 @@ Pushing a tag `vX.Y.Z` builds both apps in a containerized runner and
 publishes a Gitea Release with the versioned artifacts attached — see
 `docs/publish.md` §4. One-time setup:
 
-1. Build and push the build environment image (`./build-image.sh`, needs
-   `registry.env` — copy from `registry.env.example`).
+1. Build the build environment image locally and push it (`./build-image.sh`
+   then `./upload-image.sh`, needs `registry.env` — copy from
+   `registry.env.example`). Use `./run-image.sh` in between to sanity-check
+   the image before pushing.
 2. Register a self-hosted `act_runner` with a Docker executor.
 3. Add repo secrets under **Settings → Actions → Secrets**: