Readable job names, latest tracks main, and an AGENTS.md

Job names in the Gitea UI rendered as the raw matrix expression
("${{ fromJSON(needs.select.outputs.images) }}"). Gitea resolves a job's matrix
when it PARSES the workflow, before `needs` outputs exist, so matrix.image was
interpolated against an unresolved matrix. There is no way to win with a dynamic
matrix: jobparser.nameWithMatrix interpolates a name containing "${{ }}", and
appends "(<values>)" to one that doesn't — either way the raw expression shows.
See go-gitea/gitea#28207.

So drop the matrix. build.yaml now runs one job, "Build changed images", that
loops over the selected images and emits ::group:: markers, giving a collapsible
section per image. Also: every step has an explicit static name, because Gitea
does not interpolate expressions in names either ("Log in to ${{ env.REGISTRY }}"
rendered literally).

Tag scheme, per review: `latest` now tracks main rather than the newest release,
and `edge` is gone — it's an Alpine/Traefik convention, not a broad standard, and
`main-<sha>` already covers "a specific commit". `latest` has exactly one owner
so a release tag and a main build can't race to define it. Release tags remain
immutable `:vX.Y.Z`/`:vX.Y`/`:vX` for pinning. This also means the ToolHive
manifest's `:latest` resolves as soon as this lands on main, with no release tag
needed first.

hack/docker-tags.sh folded into hack/build-images.sh, which is now the whole
pipeline — tag, build, smoke-test, push — shared by `make build` and CI. It uses
plain `docker build` instead of buildx, dropping setup-buildx-action: it loads
into the local store so the test runs pre-publish, and emits a plain manifest
with no attestations for Gitea's registry.

Verified in a simulated runner (repo in a docker volume, socket mounted, real
runner image): select + build + group markers, all four tag modes, and the
multi-image loop with a scratch second image.

AGENTS.md records the conventions and, importantly, the three Gitea gotchas that
all look fine locally: no bind-mounting the workspace into a sibling container,
no dynamic matrix, no expressions in names.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

Makefile

@@ -43,13 +43,10 @@ shellcheck: ## Lint every shell script
 
 lint: hadolint shellcheck ## Run all linters
 
-build: ## Build IMAGE, or every image when IMAGE is unset
-	@for i in $(TARGETS); do \
-	  echo "==> building $$i"; \
-	  docker build -t $(REGISTRY)/$(NAMESPACE)/$$i:dev images/$$i || exit 1; \
-	done
+build: ## Build and smoke-test IMAGE, or every image when IMAGE is unset
+	@hack/build-images.sh $(TARGETS)
 
-test: ## Smoke-test IMAGE, or every image when IMAGE is unset
+test: ## Smoke-test an already-built IMAGE, or every image when IMAGE is unset
 	@for i in $(TARGETS); do \
 	  if [ -x images/$$i/test.sh ]; then \
 	    images/$$i/test.sh "$(if $(REF),$(REF),$(REGISTRY)/$(NAMESPACE)/$$i:dev)" || exit 1; \
@@ -58,4 +55,4 @@ test: ## Smoke-test IMAGE, or every image when IMAGE is unset
 	  fi; \
 	done
 
-all: check lint build test ## Everything CI does, locally
+all: check lint build ## Everything CI does, locally (build smoke-tests too)