Pull the base images fresh on every build (bau-pm BAU-191)

Finding 41 of bau-pm's v0.22.3 security review called this a pin to move.
It is not a pin: both bases here are floating tags, so what ships is
whatever the runner had cached. v0.1.0 went out with nginx 1.31.6 while
quay.io/nginx/nginx-unprivileged:alpine-slim had already moved to 1.31.8,
past five October CVEs - none of them reachable in a static file server
configured like this one, which is why --pull is the fix rather than a pin.

The CI build gets it too: a gate running against a months-old cached base
is not testing what the release builds.

A release is what applies this. The running image does not change until one
is cut.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -42,8 +42,13 @@ jobs:
 
       - name: build the image
         timeout-minutes: 60
+        # --pull (bau-pm BAU-191, review finding 41). Both base images are
+        # floating tags - node:20-alpine and nginx-unprivileged:alpine-slim -
+        # so the nginx and OS packages that ship are whatever the tag pointed
+        # at when the runner last pulled it. v0.1.0 went out with nginx 1.31.6
+        # while the tag had moved to 1.31.8. This is the build people run.
         run: |
-          docker build --build-arg VERSION="v$VERSION" \
+          docker build --pull --build-arg VERSION="v$VERSION" \
             -t "$REGISTRY/$IMAGE:$VERSION" -t "$REGISTRY/$IMAGE:latest" .
 
       - name: gate - nothing leaves the origin