Always rebuild images from scratch

Drop the layer-caching work: no CACHE_MODE, no registry buildcache tag, no buildx
container builder, no scheduled cache-busting build, no no_cache input.

Instead build with --no-cache --pull every time. Caching was working against the
point of this repo: nothing is version-pinned, so a cached `apk add` layer keeps
shipping whatever packages existed when it was first built, and a rebuild quietly
stops meaning "current". --no-cache alone isn't enough either — it would still
build on a stale local copy of the FROM image.

Verified the only CACHED entries left are the `# syntax=` frontend image and
--pull re-resolving the base manifest (unchanged digest). The apk and yq layers
re-run every build.

Costs ~40s per image, which also makes the four-node cache-sharing question moot.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

hack/build-images.sh

@@ -18,6 +18,14 @@
 # straight into the local image store so the smoke test can run before anything is
 # published, and it produces a plain manifest with no attestations, which Gitea's
 # registry rejects.
+#
+# Builds are always FRESH: --no-cache so every layer re-runs, and --pull so the FROM
+# image is re-resolved against the registry and replaced if the tag has moved. This
+# is the whole point of not pinning versions — a cached `apk add` layer would keep
+# shipping whatever packages existed when it was first built, and --no-cache alone
+# would still build on a stale local copy of the base image.
+#
+# Costs about 40s per image. Worth it to know that a rebuild means current.
 set -euo pipefail
 cd "$(dirname "$0")/.."
 
@@ -93,7 +101,7 @@ for image in "$@"; do
 	for tag in "${tags[@]}"; do tag_args+=(--tag "$tag"); done
 
 	group "build $image"
-	docker build "${tag_args[@]}" \
+	docker build --no-cache --pull "${tag_args[@]}" \
 		--build-arg "VERSION=$version" \
 		--build-arg "REVISION=$revision" \
 		--build-arg "CREATED=$created" \