CI: build inside bread-ecosystem's shared Arch container

Ports breadsearch onto the shared, pinned Arch build image already
proven in breadpad, so this repo's release CI stops installing its
toolchain/GTK4 stack directly on the bare self-hosted runner.

- ci/build.sh + ci/bread-ecosystem.rev: thin wrapper cloning
  bread-ecosystem pinned to a commit sha and delegating to its own
  ci/build.sh.
- dev-release.yml/rc-release.yml/release.yml: route the existing
  build/test cargo invocations through ci/build.sh, unchanged
  otherwise.
- check.yml: fast clippy/test signal on feature/**  and fix/** pushes.

No ci/deps.txt: breadmill's npu/rocm/cuda/openvino features (pulled
in by --features full) all use ort's load-dynamic (dlopen) mode, so
none of them link against a real ONNX Runtime EP at build time —
confirmed against breadmill/Cargo.toml and by breadpad already
building ort with its own rocm feature against the same base image
with no extra packages. The GUI's librsvg system dep is a runtime
icon-loader dependency (bakery.toml's system_deps), not something
linked at build/link time, so the base image's gtk4/gtk4-layer-shell
already cover what compiling breadsearch needs.

.forgejo/workflows/check.yml

@@ -0,0 +1,24 @@
+name: check
+
+# Fast-fail lint/test on short-lived work branches, before it ever reaches
+# main and triggers a dev-track release build.
+on:
+  push:
+    branches: ['feature/**', 'fix/**']
+
+jobs:
+  check:
+    runs-on: [self-hosted, hestia]
+    steps:
+      - name: checkout
+        run: |
+          set -euo pipefail
+          rm -rf src && mkdir src
+          git clone --branch "${GITHUB_REF_NAME}" --depth 1 \
+            "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
+
+      - name: clippy
+        run: cd src && bash ci/build.sh cargo clippy --workspace --all-targets --locked --features full -- -D warnings
+
+      - name: test
+        run: cd src && bash ci/build.sh cargo test --workspace --locked --features full

.forgejo/workflows/dev-release.yml

@@ -19,10 +19,10 @@ jobs:
             "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
 
       - name: build
-        run: cd src && cargo build --release --locked --workspace --features full
+        run: cd src && bash ci/build.sh cargo build --release --locked --workspace --features full
 
       - name: test
-        run: cd src && cargo test --release --locked --workspace --features full
+        run: cd src && bash ci/build.sh cargo test --release --locked --workspace --features full
 
       - name: compute dev version
         run: |

.forgejo/workflows/rc-release.yml

@@ -21,10 +21,10 @@ jobs:
             "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
 
       - name: build
-        run: cd src && cargo build --release --locked --workspace --features full
+        run: cd src && bash ci/build.sh cargo build --release --locked --workspace --features full
 
       - name: test
-        run: cd src && cargo test --release --locked --workspace --features full
+        run: cd src && bash ci/build.sh cargo test --release --locked --workspace --features full
 
       - name: prepare artifacts
         run: |

.forgejo/workflows/release.yml

@@ -22,10 +22,10 @@ jobs:
         # `backend` in config.toml. All three are ort load-dynamic (dlopen)
         # EPs, so this doesn't require the NPU/ROCm/CUDA toolkits to be
         # present on the build host — see breadmill/Cargo.toml.
-        run: cd src && cargo build --release --locked --workspace --features full
+        run: cd src && bash ci/build.sh cargo build --release --locked --workspace --features full
 
       - name: test
-        run: cd src && cargo test --release --locked --workspace --features full
+        run: cd src && bash ci/build.sh cargo test --release --locked --workspace --features full
 
       - name: prepare artifacts
         run: |

ci/bread-ecosystem.rev

@@ -0,0 +1 @@
+147cfbbf96ae4b171027defa1130d2caddb934b1

ci/build.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Delegates to bread-ecosystem's shared CI build image/script, pinned to
+# the commit in ci/bread-ecosystem.rev — not `main`. bread-ecosystem's CI
+# files now affect every product's release pipeline, so bumping the pin
+# is a deliberate act instead of silent drift (see the bread-theme test
+# that broke here for exactly that reason, before it was pinned by rev).
+#
+# Usage: ci/build.sh cargo build --release --locked
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+REV="$(cat "${ROOT}/ci/bread-ecosystem.rev")"
+
+CACHE_DIR="/tmp/bread-ecosystem-ci-${REV}"
+if [ ! -d "$CACHE_DIR" ]; then
+    rm -rf /tmp/bread-ecosystem-ci-*
+    git clone https://git.breadway.dev/Breadway/bread-ecosystem.git "$CACHE_DIR"
+    git -C "$CACHE_DIR" checkout --quiet "$REV"
+fi
+
+bash "${CACHE_DIR}/ci/build.sh" breadsearch "$ROOT" "$@"