ci: build the image with Gitea Actions

Cross-compile with a current Go toolchain (fixes stdlib CVEs of the old
image, e.g. CVE-2025-68121), append onto a pinned distroless base with
crane, publish to git.cyrilix.bzh/cyrilix/pod-volume-cleaner and upload a CycloneDX
SBOM to DependencyTrack.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -3,3 +3,17 @@
 Watch syslog file and generate alerts on orphaned pod error messages.
 
 See https://github.com/kubernetes/kubernetes/issues/105536
+
+## Container image
+
+Built by Gitea Actions (`.gitea/workflows/build.yaml`, homelab runner, no Docker, no privileges):
+the binary is cross-compiled for amd64/arm64 (CGO off, `netgo`, vendored modules, latest Go
+`GO_VERSION` patch release), appended onto the pinned `gcr.io/distroless/static-debian12` base
+with `crane` (entrypoint `/go/bin/pod-volume-cleaner`, user 1234) and published as a multi-arch image, with a
+CycloneDX SBOM uploaded to DependencyTrack:
+
+    git.cyrilix.bzh/cyrilix/pod-volume-cleaner:<tag>
+
+Release: push a `vX.Y.Z` tag to the Gitea remote. A manual run (*Run workflow*) publishes
+`test-<sha>`. The `Dockerfile` is kept for local builds only. Secrets: `REGISTRY_TOKEN`
+(user PAT, `write:package`), `DT_API_KEY`.