ci: add shared Arch build image/script for GTK4 product repos

breadpad's CI used to rebuild libadwaita from source in an uncached
Fedora container on every push and broke repeatedly on version drift.
The fix there was a pinned Arch container (current gtk4/libadwaita/
gtk4-layer-shell/graphene are prebuilt pacman packages, no source
build needed) — this centralizes that image/script here so every
GTK4 layer-shell product in the ecosystem can share it instead of
each repo carrying its own copy.

ci/build.sh takes a product repo root + cargo command, and reads an
optional ci/deps.txt from that repo for product-specific extra pacman
packages (EXTRA_PKGS build-arg) without forking the Containerfile.

Product repos should pin this to a commit sha, not track main — an
unrelated change here would otherwise silently affect every product's
next release build.

ci/Containerfile

@@ -0,0 +1,30 @@
+# Shared CI build environment for bread-ecosystem GTK4/libadwaita apps.
+#
+# Arch base: current gtk4/libadwaita/gtk4-layer-shell/graphene are all
+# available as prebuilt pacman packages, so no from-source library builds
+# are needed (unlike Fedora, where breadpad's CI used to rebuild libadwaita
+# from source on every single run and broke repeatedly on version drift).
+#
+# Base image pinned by digest, package set frozen at build time: this image
+# only changes when someone deliberately rebuilds it, not on every push.
+# Product repos that depend on this file should pin it to a commit sha
+# (see each product's ci/bread-ecosystem.rev), not track `main` — otherwise
+# an unrelated change here silently breaks every product's next release.
+#
+# EXTRA_PKGS lets a product layer on extra pacman packages (see that
+# product's ci/deps.txt) without forking this file.
+FROM archlinux@sha256:fae033b815a16f930325c2697e620362be4d2e5d739a301b10ad1fc9c8643a06
+
+ARG EXTRA_PKGS=""
+
+RUN pacman -Syu --noconfirm --needed \
+        base-devel \
+        git \
+        pkgconf \
+        rust \
+        gtk4 \
+        libadwaita \
+        gtk4-layer-shell \
+        graphene \
+        ${EXTRA_PKGS} \
+    && pacman -Scc --noconfirm