fix: build CI image locally in test job to avoid stale registry pull

prop-ci:latest on the registry may not have the latest Dockerfile.ci
changes when the test step runs. Build the image locally using
--cache-from for speed, then use the local tag.

.forgejo/workflows/build.yaml

@@ -126,6 +126,20 @@ jobs:
               mix assets.setup && \
               mix compile --warnings-as-errors'
 
+      - name: Build CI test image locally
+        run: |
+          set -euo pipefail
+          # Build the CI image from the current Dockerfile.ci. Use the
+          # registry image for layer caching so repeated builds are fast.
+          # The build-ci-image pre-req job keeps the cache warm.
+          CI_IMAGE="${REGISTRY}/${OWNER}/${CI_IMAGE_NAME}"
+          DOCKER_BUILDKIT=1 docker build \
+            --file Dockerfile.ci \
+            --build-arg BUILDKIT_INLINE_CACHE=1 \
+            --cache-from "${CI_IMAGE}:latest" \
+            --tag prop-ci:local \
+            .
+
       - name: Run tests
         run: |
           set -euo pipefail
@@ -137,7 +151,7 @@ jobs:
             -e MIX_ENV=test \
             --network host \
             -w /app \
-            git.mcintire.me/graham/prop-ci:latest \
+            prop-ci:local \
               sh -euc '\
               mkdir -p /app && cd /app && tar xf - && \
               mix deps.get && \