Split the monolithic build-image.sh into three scripts: build-image.sh now only builds locally, run-image.sh

runs dist.sh inside that local image via a bind mount, andcupload-image.sh pushes the already-built image.
The Dockerfile also warms the Gradle dependency cache in a throwaway build stage, and pre-installs
the pinned CMake version, so `run-image.sh` doesn't re-download the same Maven dependencies on every run.

dist.sh now strips the -pre+meta suffix before writing package.json's version, since Pebble's build
tooling parses it strictly as X.Y.Z integers and was rejecting suffixed versions.

docs/publish.md

@@ -249,11 +249,11 @@ be bumped in source files beforehand (`dist.sh` patches `versionCode`/
 running the same thing locally).
 
 The whole toolchain (Android SDK/NDK, Pebble SDK) lives in
-`build-image/Dockerfile`, built and pushed to a container registry by
-`build-image.sh`. This keeps the setup portable: the runner just needs Docker
-and pulls that image, so it isn't tied to any one machine's local toolchain
-install and can be moved or re-registered elsewhere without touching this
-repo's build scripts.
+`build-image/Dockerfile`, built locally and pushed to a container registry by
+three separate scripts (below). This keeps the setup portable: the runner
+just needs Docker and pulls that image, so it isn't tied to any one machine's
+local toolchain install and can be moved or re-registered elsewhere without
+touching this repo's build scripts.
 
 ### 4.1 Build environment image
 
@@ -262,9 +262,14 @@ pinned in `app/build.gradle.kts`, matching what's validated for local builds.
 It does **not** contain the release keystore — that's injected at job runtime
 from Actions secrets (§4.3), never baked into the image.
 
+Three scripts, kept separate so a Dockerfile change can be built and tested
+locally before anything is pushed to the registry:
+
 ```bash
 cp registry.env.example registry.env   # fill in your registry credentials
-./build-image.sh                       # builds + pushes :latest and the pinned VERSION tag
+./build-image.sh                       # builds :latest and the pinned VERSION tag, locally only
+./run-image.sh                         # runs dist.sh inside that local image — sanity-check before publishing
+./upload-image.sh                      # pushes the already-built :latest and VERSION tag to cr.ladkau.de
 ```
 
 Rebuild and push whenever `build-image/Dockerfile` changes (e.g. a Pebble SDK
@@ -329,12 +334,19 @@ Watch the run under the repo's Actions tab. On success, the release appears
 under the repo's Releases page with the three versioned artifacts attached.
 
 To build the same versioned artifacts locally without pushing a tag (e.g. to
-test before releasing):
+test before releasing), either run `dist.sh` directly with the host toolchain:
 
 ```bash
 VERSION=1.2.3 ./dist.sh
 ```
 
+or run it inside the build-image container (same environment the runner
+uses — see §4.1):
+
+```bash
+./run-image.sh 1.2.3
+```
+
 ## 5. Pebble watch app → Rebble app store / direct distribution
 
 The official Pebble app store shut down years ago; the community-run