ci: image build needs no outbound net — copy job-installed node_modules; base alpine→slim

.gitea/workflows/ci.yml

@@ -36,8 +36,7 @@ jobs:
         with:
           node-version: 22
 
-      # bun drives installs (repo ships bun.lock, no package-lock.json); pinned to the
-      # same major as oven/bun in the Dockerfile.
+      # bun drives installs (repo ships bun.lock, no package-lock.json); pinned to 1.4.2.
       # Retried: the runner's outbound network/DNS is flaky (transient EAI_AGAIN seen in CI).
       - name: Install bun
         run: |
@@ -95,6 +94,11 @@ jobs:
       - name: Install browsers (local)
         run: npx playwright install --with-deps chromium
 
+      # Cache the base image on the shared daemon up front: a single loud failure here
+      # beats a 6-minute BuildKit "failed to solve" when the daemon's outbound net is down.
+      - name: Pull e2e base image
+        run: docker pull node:22-slim
+
       # Pre-build the e2e image with retries (flaky runner network); the E2E step's own
       # build then becomes a fast no-op. Plain progress keeps BuildKit output visible.
       - name: Build e2e image (retries)