ci: build the e2e image once and hand it to every leg

[onedr0p]

Ports the e2e half of home-operations/miroir#371 to tuppr.

Every leg rebuilt the controller image itself: four builds racing one GHA cache scope, with an ordering hack (matrix.leg == '3cp-0w') so only one leg wrote the scope back. A new e2e-image job builds it once, exports it with docker save, and hands it to the matrix as an artifact. Each leg loads it into its own runner-local registry while its VMs boot, so the nodes still pull over loopback and every leg now installs identical bytes.

The leg-splitting half of the miroir change does not apply here: tuppr's legs are already one cluster shape each, with no doubled-up suite to separate.

• PUSH_IMAGE moves to the workflow env, since both jobs now use it; CONTROLLER_IMAGE stays on the legs.
• Legs drop buildx, the build step, and the Go version lookup that only fed it.
• Export uses shell: bash for the pipefail the implicit bash -e default lacks, or a failed save would pass the step on gzip's exit status and hand every leg a truncated tarball.
• The zizmor cache-poisoning note is rewritten for the job that now does the building, and test/e2e-qemu/README.md for how CI gets its image.

Verified locally: actionlint and zizmor clean under the same invocation the shared workflow-lint action uses, and the save/gzip/load/push sequence smoke-tested against a loopback registry:3.

[greptile-apps]

Greptile Summary

The PR centralizes the end-to-end controller image build and distributes the resulting image artifact to every test leg.

• Adds an e2e-image job that builds, compresses, and uploads the controller image once.
• Updates each go-e2e leg to download, load, and push the identical image into its runner-local registry.
• Moves the shared push image name to workflow-level environment configuration and updates status-job dependencies.
• Updates Zizmor configuration comments and end-to-end documentation to describe the new image flow.

Confidence Score: 5/5

The PR appears safe to merge with no actionable defects identified in the centralized image handoff.

The producer and consumer jobs use matching artifact paths and image tags, each test leg loads the image before running tests, and failures in the new prerequisite remain visible to the aggregate status job.

T-Rex Logs

What T-Rex did

• I examined the before-run log to locate why the parent workflow failed due to the absent producer job.
• I opened the after-run log and confirmed that all image-handoff assertions pass.
• I reviewed the Docker runtime availability log to identify the exact runtime blocker affecting the handoff.
• I checked the Python script that defines the image handoff workflow to verify the end-to-end handoff sequence, including e2e-image.tar.gz, the local push to localhost:5000/tuppr:e2e, and the registry.e2e/tuppr:e2e supplied to the test.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
.github/workflows/ci.yaml	The new build-once artifact handoff preserves registry naming, job ordering, image availability, and aggregate status propagation without an identified defect.
.github/zizmor.yml	Updates the existing cache-poisoning exemption rationale to accurately describe the centralized image-build job.
test/e2e-qemu/README.md	Documents the new CI image build, artifact distribution, and runner-local registry workflow.
test/e2e-qemu/test.sh	Updates comments to reflect that CI now loads a prebuilt image while the cluster boots, without changing runtime behavior.

_{Reviews (1): Last reviewed commit: "ci: build the e2e image once and hand it..." | Re-trigger Greptile}