Split the monolithic build-image.sh into three scripts: build-image.sh now only builds locally, run-image.sh

runs dist.sh inside that local image via a bind mount, andcupload-image.sh pushes the already-built image.
The Dockerfile also warms the Gradle dependency cache in a throwaway build stage, and pre-installs
the pinned CMake version, so `run-image.sh` doesn't re-download the same Maven dependencies on every run.

dist.sh now strips the -pre+meta suffix before writing package.json's version, since Pebble's build
tooling parses it strictly as X.Y.Z integers and was rejecting suffixed versions.

.gitea/workflows/release.yml

@@ -32,6 +32,11 @@ jobs:
       credentials:
         username: ${{ secrets.REGISTRY_USER }}
         password: ${{ secrets.REGISTRY_PASSWORD }}
+      # Without this, the runner's Docker daemon reuses whatever it already
+      # has cached locally under the `:latest` tag and never notices a newer
+      # image was pushed — options: is passed straight through to
+      # `docker create`, which supports --pull since Docker 20.10.
+      options: --pull=always
 
     steps:
       - uses: actions/checkout@v4