ci: build on bread-ecosystem's shared Arch container

Route dev/beta/release build steps through ci/build.sh, pinned to
bread-ecosystem@147cfbb, instead of installing toolchain/libraries
directly on the bare runner. Adds ci/deps.txt for the build-time-only
packages breadcast needs beyond the shared image's base set (jsoncpp
and libcrypto for breadcast-caststream-sys's build.rs; gstreamer and
gst-plugins-base-libs for the gstreamer-app/-video sys crates) --
deliberately excludes bakery.toml's runtime-only plugin deps
(pipewire/bad/hlssink3/va), which are loaded dynamically by name and
never linked at compile time. Also adds check.yml to run clippy/test
on feature/fix branches ahead of a release build, matching breadpad's
already-migrated pattern.

ci/build.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Delegates to bread-ecosystem's shared CI build image/script, pinned to
+# the commit in ci/bread-ecosystem.rev — not `main`. bread-ecosystem's CI
+# files now affect every product's release pipeline, so bumping the pin
+# is a deliberate act instead of silent drift (see the bread-theme test
+# that broke here for exactly that reason, before it was pinned by rev).
+#
+# Usage: ci/build.sh cargo build --release --locked
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+REV="$(cat "${ROOT}/ci/bread-ecosystem.rev")"
+
+CACHE_DIR="/tmp/bread-ecosystem-ci-${REV}"
+if [ ! -d "$CACHE_DIR" ]; then
+    rm -rf /tmp/bread-ecosystem-ci-*
+    git clone https://git.breadway.dev/Breadway/bread-ecosystem.git "$CACHE_DIR"
+    git -C "$CACHE_DIR" checkout --quiet "$REV"
+fi
+
+bash "${CACHE_DIR}/ci/build.sh" breadcast "$ROOT" "$@"