ci: build on bread-ecosystem's shared Arch container

Route dev/beta/release build steps through ci/build.sh, pinned to
bread-ecosystem@147cfbb, instead of installing toolchain/libraries
directly on the bare runner. Adds ci/deps.txt for the build-time-only
packages breadcast needs beyond the shared image's base set (jsoncpp
and libcrypto for breadcast-caststream-sys's build.rs; gstreamer and
gst-plugins-base-libs for the gstreamer-app/-video sys crates) --
deliberately excludes bakery.toml's runtime-only plugin deps
(pipewire/bad/hlssink3/va), which are loaded dynamically by name and
never linked at compile time. Also adds check.yml to run clippy/test
on feature/fix branches ahead of a release build, matching breadpad's
already-migrated pattern.

.forgejo/workflows/dev-release.yml

@@ -20,7 +20,7 @@ jobs:
             "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
 
       - name: build
-        run: cd src && cargo build --release --locked
+        run: cd src && bash ci/build.sh cargo build --release --locked
 
       - name: compute dev version
         run: |