CI: replace from-source libadwaita build with pinned Arch container

The dev/rc/release workflows rebuilt libadwaita from source inside an
uncached Fedora container on every single run, because Ubuntu 24.04's
packaged libadwaita was too old for gtk4 0.11's v4_12 feature. That
from-source build broke repeatedly on drift (rust dep versions,
libadwaita ABI, and finally a removed meson option), producing eight
straight failed CI runs.

Arch's repos already carry current gtk4/libadwaita/gtk4-layer-shell as
prebuilt packages, and breadpad only targets BOS/Arch, so there's no
reason to build anything from source. Swap the container base to a
digest-pinned archlinux image (ci/Containerfile) with those packages
installed via pacman, and extract the shared "build the image, run
cargo inside it" logic into ci/build.sh so it isn't duplicated three
times across the workflows. Cargo's registry/git/target caches persist
in named docker volumes across runs.

Also:
- Add check.yml: clippy + test on feature/**/fix/** pushes, so lint/
  build breakage surfaces before it reaches main and triggers a
  dev-track release.
- Fix release.yml's tag trigger (tags-ignore) so an rc tag push no
  longer also spawns a skipped release.yml run alongside rc-release.yml.

Verified locally: the container builds cleanly via pacman (no source
compilation), and `cargo build --release --locked --workspace` inside
it produces working breadpad/breadman binaries linked against
libgtk4-layer-shell.so.0 and libadwaita-1.so.0 respectively.

.forgejo/workflows/rc-release.yml

@@ -2,11 +2,10 @@ name: beta (rc) release
 
 on:
   push:
-    tags: ['v*']
+    tags: ['v*-rc.*']
 
 jobs:
   build:
-    if: ${{ contains(github.ref_name, '-rc.') }}
     runs-on: [self-hosted, hestia]
     steps:
       - name: checkout
@@ -16,27 +15,8 @@ jobs:
           git clone --branch "${GITHUB_REF_NAME}" --depth 1 \
             "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
 
-      - name: build inside container
-        run: |
-          docker run --rm \
-            -v "$(pwd)/src:/workspace" \
-            -w /workspace \
-            fedora:41 \
-            bash -c "
-              set -euo pipefail
-              dnf install -y gcc gcc-c++ pkgconf-pkg-config git curl meson ninja-build valac gtk4-devel graphene-devel
-              
-              # Build Libadwaita 1.7.0 from source inside container (skipping tests & docs)
-              git clone https://gitlab.gnome.org/GNOME/libadwaita.git --branch 1.7.0 --depth 1 /tmp/libadwaita
-              meson setup /tmp/libadwaita/build /tmp/libadwaita --prefix=/usr -Dtests=false -Ddoc=false
-              ninja -C /tmp/libadwaita/build
-              ninja -C /tmp/libadwaita/build install
-
-              # Install Rust and build
-              curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
-              source \$HOME/.cargo/env
-              cargo build --release --locked
-            "
+      - name: build
+        run: cd src && bash ci/build.sh cargo build --release --locked
 
       - name: prepare artifacts
         run: |
@@ -68,4 +48,4 @@ jobs:
           ECOSYSTEM_CI_DIR="$(mktemp -d /tmp/bread-ecosystem-ci-XXXXXX)"
           git clone https://git.breadway.dev/Breadway/bread-ecosystem.git "${ECOSYSTEM_CI_DIR}"
           TRACK=beta bash "${ECOSYSTEM_CI_DIR}/scripts/gen-index.sh"
-          rm -rf "${ECOSYSTEM_CI_DIR}"
+          rm -rf "${ECOSYSTEM_CI_DIR}"