ci: use bread-ecosystem's shared Arch build image/script

Moves the Containerfile and build.sh added in the previous CI fix up
into bread-ecosystem/ci/, so other GTK4 layer-shell products in the
ecosystem can share it instead of each carrying their own copy. This
repo's ci/build.sh is now a thin wrapper that clones bread-ecosystem
at the commit pinned in ci/bread-ecosystem.rev and delegates to its
ci/build.sh — pinned by sha rather than tracking main, so an unrelated
change over there can't silently break this repo's release builds
(the failure mode the bread-theme test fix a moment ago was caused by).

Verified locally: clippy, test, and release build all pass through
the new delegator path.

ci/Containerfile

@@ -1,22 +0,0 @@
-# Pinned CI build environment for breadpad.
-#
-# Arch instead of Fedora because breadpad targets BOS/Arch only, and Arch's
-# repos already carry current libadwaita/gtk4/gtk4-layer-shell as prebuilt
-# packages — no from-source libadwaita build needed (that from-source build
-# was the repeated CI breakage: rust dep mismatches, libadwaita ABI
-# mismatches, and finally a removed meson option).
-#
-# Base image pinned by digest, package set frozen at build time: this image
-# only changes when someone deliberately rebuilds it, not on every push.
-FROM archlinux@sha256:fae033b815a16f930325c2697e620362be4d2e5d739a301b10ad1fc9c8643a06
-
-RUN pacman -Syu --noconfirm --needed \
-        base-devel \
-        git \
-        pkgconf \
-        rust \
-        gtk4 \
-        libadwaita \
-        gtk4-layer-shell \
-        graphene \
-    && pacman -Scc --noconfirm

ci/bread-ecosystem.rev

@@ -0,0 +1 @@
+cd5da468b3782fddcb52b4eaff0755ff933524be

ci/build.sh

@@ -1,31 +1,21 @@
 #!/usr/bin/env bash
-# Builds (or reuses, via docker's own layer cache) the pinned Arch CI image
-# from ci/Containerfile, then runs the given cargo command inside it against
-# this repo checkout.
-#
-# Cargo's registry/git caches and CARGO_TARGET_DIR are persisted in named
-# docker volumes so they survive across runs even though the repo checkout
-# itself (a fresh --depth 1 clone per workflow run) does not.
+# Delegates to bread-ecosystem's shared CI build image/script, pinned to
+# the commit in ci/bread-ecosystem.rev — not `main`. bread-ecosystem's CI
+# files now affect every product's release pipeline, so bumping the pin
+# is a deliberate act instead of silent drift (see the bread-theme test
+# that broke here for exactly that reason, before it was pinned by rev).
 #
 # Usage: ci/build.sh cargo build --release --locked
 set -euo pipefail
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-cd "$ROOT"
+REV="$(cat "${ROOT}/ci/bread-ecosystem.rev")"
 
-docker build -t breadpad-ci:archlinux -f ci/Containerfile ci
+CACHE_DIR="/tmp/bread-ecosystem-ci-${REV}"
+if [ ! -d "$CACHE_DIR" ]; then
+    rm -rf /tmp/bread-ecosystem-ci-*
+    git clone https://git.breadway.dev/Breadway/bread-ecosystem.git "$CACHE_DIR"
+    git -C "$CACHE_DIR" checkout --quiet "$REV"
+fi
 
-docker run --rm \
-    -v "${ROOT}:/workspace" \
-    -v breadpad-cargo-registry:/root/.cargo/registry \
-    -v breadpad-cargo-git:/root/.cargo/git \
-    -v breadpad-cargo-target:/cargo-target \
-    -w /workspace \
-    -e CARGO_TARGET_DIR=/cargo-target \
-    breadpad-ci:archlinux \
-    bash -c '
-        set -euo pipefail
-        "$@"
-        mkdir -p /workspace/target
-        cp -a /cargo-target/. /workspace/target/
-    ' bash "$@"
+bash "${CACHE_DIR}/ci/build.sh" "$ROOT" "$@"