ci(infra): build images locally in test jobs; publish post-merge

The test jobs were pulling a pre-published infra rootfs artifact from the
registry, which made CI dependent on an out-of-band publish step. Test suites
should be self-contained.

- Set BOT_BOTTLE_INFRA_BUILD=local in integration-firecracker and coverage
  so both jobs build agent and infra images from the checked-out source.
- Add publish-infra.yml: a separate workflow that fires after the test
  workflow succeeds on main, builds the same rootfs, and uploads it to the
  Gitea generic-package registry for operators who want the pull path.
- Registry credentials (BOT_BOTTLE_INFRA_ARTIFACT_TOKEN) are only needed
  by the post-merge publish job, never by test jobs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/test.yml

@@ -25,10 +25,8 @@ on:
       - '.gitea/workflows/**.yml'
       - 'scripts/**'
       - 'README.md'
-      # The Firecracker infra artifact the integration/coverage jobs pull is
-      # versioned by a content hash of the Dockerfiles (+ bot_bottle/, init);
-      # pyproject.toml drives the in-image package install. Changes here alter
-      # what those jobs build/pull, so they must re-run the suite.
+      # Dockerfiles and pyproject.toml are baked into the infra rootfs; a
+      # change here alters what the integration/coverage jobs build locally.
       - 'Dockerfile*'
       - 'pyproject.toml'
   pull_request:
@@ -120,6 +118,10 @@ jobs:
       - name: Run integration tests (firecracker)
         env:
           BOT_BOTTLE_BACKEND: firecracker
+          # Build images locally from the checked-out source — never pull a
+          # pre-published artifact during tests. Publishing happens post-merge
+          # in publish-infra.yml.
+          BOT_BOTTLE_INFRA_BUILD: local
         run: python3 -m unittest discover -t . -s tests/integration -v
 
   # Combined unit+integration coverage + the diff-coverage gate (the hard
@@ -138,6 +140,10 @@ jobs:
   #
   # See #414 for the planned follow-up: artifact-based coverage combination
   # (run tests once in their respective jobs, combine .coverage files here).
+  #
+  # BOT_BOTTLE_INFRA_BUILD=local: build images from source here, never pull a
+  # pre-published artifact. Registry publishing runs post-merge in
+  # publish-infra.yml, gated on tests passing.
   coverage:
     timeout-minutes: 15
     runs-on: [self-hosted, kvm]
@@ -166,6 +172,8 @@ jobs:
       # module to install into anyway. `scripts/coverage.sh` +
       # `diff_coverage.py` need only `coverage` (not pylint/pyright).
       - name: Combined coverage (unit + integration, incl. firecracker)
+        env:
+          BOT_BOTTLE_INFRA_BUILD: local
         run: PYTHON=python3 bash scripts/coverage.sh critical
 
       - name: Diff-coverage gate (changed lines >= 90%)