Restore the weekly image rebuild

[rmachielse]

Summary

Restores Build-Test-Push, which has failed every run since 2026-07-13 — six consecutive weekly schedules plus every push and PR. The pinned v1.2.3 of ruby-versions-action pulls ruby-version-checker unpinned, and that binary now requires a subcommand (check or docker). Invoked with the old positional arguments it prints its usage text and exits, so versions and metadata come back empty, the matrix expands to nothing, build-test-push never runs and merge-manifests is skipped.

Consequences of the outage: ghcr.io/feedbackfruits/ruby-jemalloc:3.4.10-slim is still the 2026-07-09 build over a Debian rootfs from 2026-06-23, and every downstream service inherits it. Trivy reports 90 fixable HIGH findings on it, 73 of them linux-libc-dev kernel headers and the rest small and real — libexpat1, curl, util-linux. No Ruby release published since then reached the registry either, so downstream repos cannot adopt one.

Pinning to v2.0.0 restores version discovery. A run on this branch built the full matrix green, including Ruby 4.0.6 on both architectures, which has never been through this pipeline before.

Alternatives considered

v1.2.4 is the only release that digest-pins the checker, and it was the first choice for that reason. Its frozen checker turns out to be frozen in its version list too: it reports 3.1.7 through 3.4.10, so Ruby 4.0 would never reach the registry and EOL 3.1 would keep being built and published. A run on this branch confirmed both the fix and that list. v2.0.0 reports 3.2 through 4.0.6, matching what upstream builds green each week.

v2.0.0 pulls the checker as :latest, so this class of break can recur, and nothing here would announce it. That is a real gap and it is accepted deliberately rather than solved: the six-week outage happened because a failing schedule told nobody, and fixing that needs a channel decision — Slack, matching the API repo's deploy notifications, would need a SLACK_WEBHOOK_URL secret this repository does not have. Tracked in SWE-510.

Syncing the fork wholesale would bring upstream's floating @v2 reference along with floating tags throughout, which the zizmor high/high gate rejects, and three Ubuntu variants for tags nothing consumes. Upstream also still omits the jemalloc LD_PRELOAD and MALLOC_CONF settings added here in #1, so their images cannot replace ours.

Worth noting for the pinning policy: neither zizmor nor pinact can catch this class of failure. They verify the ref we write, while the break came from a Dockerfile inside the action. A SHA-pinned action is only as pinned as its own base images.

Follow-up

Failure visibility and a reporting-only Trivy scan here, where a finding is actionable because republishing is the fix, are tracked in SWE-510.

Fixes SWE-510