fix(ci): unblock Forgejo image build for vergabe-teilnahme

Use uv sync --frozen so Docker builds consume the pinned uv.lock instead
of resolving issue-core from Forgejo PyPI before that package is mirrored.
Align image.yaml with the canonical container-build template.

.forgejo/workflows/image.yaml

@@ -1,5 +1,5 @@
 # Container image publish to forgejo.coulomb.social (RAILIANCE-WP-0014).
-# Org secrets: REGISTRY_USER, REGISTRY_TOKEN; optional FORGEJO_PYPI_USER, FORGEJO_PYPI_TOKEN
+# Org secrets: REGISTRY_USER, REGISTRY_TOKEN
 name: Build and Publish Container Image
 
 on:
@@ -31,28 +31,21 @@ jobs:
         env:
           REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
           REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
-          FORGEJO_PYPI_USER: ${{ secrets.FORGEJO_PYPI_USER }}
-          FORGEJO_PYPI_TOKEN: ${{ secrets.FORGEJO_PYPI_TOKEN }}
         run: |
           set -eu
           REF="${GITHUB_SHA:-main}"
-          SHORT="${REF:0:7}"
           mkdir -p buildctx "${HOME}/bin"
           wget -qO /tmp/repo.tar.gz \
-            "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${SHORT}.tar.gz"
+            "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${REF}.tar.gz"
           tar xzf /tmp/repo.tar.gz -C buildctx --strip-components=1
           wget -qO- https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz \
             | tar xz --strip-components=1 -C "${HOME}/bin" docker/docker
           export PATH="${HOME}/bin:${PATH}"
+          docker version
           echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
+          SHORT="${REF:0:7}"
           IMAGE="${REGISTRY}/${IMAGE_NAME}"
-          BUILD_ARGS=()
-          if [ -n "${FORGEJO_PYPI_USER:-}" ] && [ -n "${FORGEJO_PYPI_TOKEN:-}" ]; then
-            BUILD_ARGS+=(--secret "id=forgejo_pypi_user,env=FORGEJO_PYPI_USER")
-            BUILD_ARGS+=(--secret "id=forgejo_pypi_password,env=FORGEJO_PYPI_TOKEN")
-          fi
-          docker build "${BUILD_ARGS[@]}" \
-            -t "${IMAGE}:latest" -t "${IMAGE}:${SHORT}" -t "${IMAGE}:main-${SHORT}" buildctx
+          docker build -t "${IMAGE}:latest" -t "${IMAGE}:${SHORT}" -t "${IMAGE}:main-${SHORT}" buildctx
           docker push "${IMAGE}:latest"
           docker push "${IMAGE}:${SHORT}"
           docker push "${IMAGE}:main-${SHORT}"

Dockerfile

@@ -50,7 +50,7 @@ RUN --mount=type=secret,id=forgejo_pypi_user,required=false \
       if [ -f /run/secrets/forgejo_pypi_password ]; then \
         export UV_INDEX_FORGEJO_PASSWORD="$(cat /run/secrets/forgejo_pypi_password)"; \
       fi; \
-      uv sync --no-dev --no-install-project \
+      uv sync --frozen --no-dev --no-install-project \
     '