ci: align pipeline on web/mydl pattern

Refactor the 4 trigger workflows to call a shared _ci-common.yaml
(hadolint + build-test), like web/mydl:

- pr.yaml       -> PR checks via _ci-common (concurrency group, dispatch)
- main.yaml     -> CI + cached load-build + git semver tag (PAT)
- tag.yaml      -> CI + build/push :vX.Y.Z and :vX.Y.Z-latest
- cron.yaml     -> nightly rebuild of :vX.Y.Z-latest
- _ci-common.yaml -> hadolint (step-level continue-on-error) + build-test
                     with GHA cache, load:true and tests/test.sh actually run
                     (real HTTP smoke tests - they existed but were never
                     invoked by any workflow)

Fixes: main.yaml tag job had a corrupted remote URL line; tests never ran
on any trigger path.

.gitea/workflows/main.yaml

@@ -1,40 +1,43 @@
 name: Main Release
 on:
+  workflow_dispatch:
   push:
     branches: [main]
 jobs:
-  hadolint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
-        continue-on-error: true
-        with:
-          dockerfile: Dockerfile
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
-      - run: docker build -t ci-image:${{ github.sha }} .
+  ci:
+    uses: ./.gitea/workflows/_ci-common.yaml
+    secrets: inherit
   build:
-    needs: [test]
+    needs: [ci]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
-      - run: docker build -t jcabillot/opencode-openchamber:${{ github.sha }} .
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
+      - name: Build (cached)
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+        with:
+          context: .
+          file: Dockerfile
+          push: false
+          load: true
+          tags: jcabillot/opencode-openchamber:${{ github.sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
   tag:
     needs: [build]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
       - name: Configure git auth
         run: |
           git remote set-url origin "https://x-access-token:${{ secrets.SA_TOKEN_ACTION_PUSH_TAGS }}@scm.cabillot.eu/perso/opencode-openchamber.git"
-      - uses: anothrNick/github-tag-action@4ed44965e0db8dab2b466a16da04aec3cc312fd8 # v1.75.0
+      - name: Bump version and push tag
+        uses: anothrNick/github-tag-action@4ed44965e0db8dab2b466a16da04aec3cc312fd8 # v1.75.0
         env:
           GITHUB_TOKEN: ${{ secrets.SA_TOKEN_ACTION_PUSH_TAGS }}
           DEFAULT_BUMP: patch