ci: revert to Docker image build + registry push (no deploy)

Drop the LXC deploy step. Pipeline now stops at publishing the image
to the Gitea registry; deployment is handled out of band.

Restored:
- Dockerfile (multi-stage: curl-builder + quarkus-micro-image:2.0,
  generic via build-output/*-runner wildcard, COPY --chown=1001:1001)
- compose.yaml (one-shot install of the published image)
- .dockerignore (excludes build-output/)

CI workflow:
- Installs docker-buildx (needed for COPY --chown)
- Uses docker buildx build
- chmod 775 and echo securerandom happen in the 'Stage binary for Docker'
  step; the final image has no RUN commands
- Tags :latest and :<short-sha>, pushes with retry

No deploy step. Pull the image with docker compose / run it manually.

Dockerfile

@@ -0,0 +1,19 @@
+FROM registry.access.redhat.com/ubi9/ubi-minimal AS curl-builder
+RUN microdnf install -y curl-minimal && microdnf clean all \
+ && mkdir -p /out/etc/pki /out/etc \
+ && install -D -m 0755 /usr/bin/curl /out/usr/bin/curl \
+ && for lib in $(ldd /usr/bin/curl | awk '/=>/ {print $3}' | sort -u); do \
+      install -D -m 0755 "$lib" "/out$lib"; \
+    done \
+ && cp -rP /etc/pki/ca-trust /out/etc/pki/ \
+ && cp -rP /etc/ssl /out/etc/
+
+FROM quay.io/quarkus/quarkus-micro-image:2.0
+WORKDIR /work/
+COPY --chown=1001:1001 build-output/*-runner /work/application
+COPY --from=curl-builder /out/ /
+
+EXPOSE 8080
+USER 1001
+
+ENTRYPOINT ["./application"]