ci: artifact handoff + buildkit /proc/acpi fix + auto-versioned kernel releases

[lacraig2]

This PR makes three related changes to .github/workflows/build.yml.

1. Build→aggregate handoff via workflow artifacts

The kernel pipeline (build matrix → aggregate) passed per-target tarballs through a shared hostPath (/home/runner/_shared/runs/$GITHUB_RUN_ID/build-output): build wrote them, aggregate read them back. That only works while all rehosting-arc runners are pinned to one node.

Now:

• build uploads kernels-<target> via actions/upload-artifact
• aggregate pulls them with actions/download-artifact (merge-multiple) into a workspace-local build-output/, then combines/releases exactly as before.

The obsolete per-run runs/ cleanup is removed (artifacts expire on retention; the workspace dir is ephemeral). Combine/merge/release logic is unchanged.

Why: removes the last cross-node dependency in rehosting CI, so the rehosting-arc scale set can drop its single-node nodeSelector and spread across both cluster nodes (downstream kube change).

2. Fix buildkit /proc/acpi regression (unblocks all builds)

The buildx setup pinned image=moby/buildkit:master. A recent master regressed runc on the kernel-5.4 self-hosted runners:

runc run failed: ... can't mask dir "/proc/acpi": mount ... MS_RDONLY ... invalid argument

failing the first RUN of every image build — which is why the build matrix went all-red after 2026-05-17 with no workflow change of its own. Dropping the image= pin lets buildx use its default pinned-stable buildkit (runc v1.3.3). network=host and the registry config are kept. Mirrors rehosting/penguin c35bedc5 (same fix also applied in rehosting/embedded-toolchains).

3. Auto-versioned kernel releases (like rehosting/penguin)

Releases now cut on merges to main and dev_* tags (was: manual v* tag pushes). Version is computed by reecetech/version-increment (use_api) and the release is tagged vX.Y.Z; dev_* tags publish as prereleases.

• The v* push trigger is dropped — the release step now creates v* tags, so a v* trigger would re-fire the workflow indefinitely.
• workflow_dispatch still runs build+aggregate (to validate the pipeline) but does not publish a release.
• Per-ref concurrency added so concurrent main merges can't race the version bump onto the same tag.

Test plan

• PR run: build matrix passes (buildkit fix verified live).
• workflow_dispatch run: aggregate downloads all kernels-* artifacts, combines, and produces kernels-latest.tar.gz + kernel-devel-all.tar.gz.
• Round-trip contents equivalence verified by local simulation of upload → merge-multiple download → combine/osi.config-merge.
• (post-merge) downstream kube nodeSelector drop → runners spread to both nodes.

4. Slim kernel-devel-all (~75–85% smaller)

The per-target kernel-devel tree shipped the full source/build trees — tools/ (88 MB x86_64 / 267 MB arm64), prebuilt .o (183 MB), boot images/vmlinux (166 MB), .cmd (23 MB) — none of which an out-of-tree module build reads. Pruned in _in_container_build.sh to the modules_prepare result (Makefile/.config/Module.symvers, include/ incl. generated, arch//include + Makefiles, scripts/ host tools). Keeps tools/objtool and arch/powerpc/lib/crtsavres.o (igloo_driver links it on ppc). Also fixes a latent bug where the x86_64 arch/${short_arch}/boot removal was a no-op (real dir is arch/x86), so ~120 MB of bzImage/vmlinux shipped.

Measured (run 27795353512): x86_64 devel 244 MB → 25 MB compressed (605 → 111 MB uncompressed), including the kernel .c strip; powerpc → 14 MB / 61 MB.

Verified: all 13 builds green; igloo_driver modules build green against the slimmed trees (incl. .c removal) for x86_64 (4.10 + 6.13) and powerpc (6.13, exercises the crtsavres.o link). Confirmed crtsavres.o is preserved where it exists and was already absent (not removed by this change) for powerpc64/powerpc-4.10.

5. Node-agnostic kernel sources (per-node lazy cache)

prebuild used to populate the shared /home/runner/_shared/linux_sources hostPath and every build job mounted it — so build had to land on prebuild's node (the reason rehosting-arc was nodeSelector-pinned). Moved source prep into a per-node "Ensure kernel sources on this node" step in each build job: SHA-keyed under linux_sources/<key>/, flock-arbitrated (first job on a node populates, the rest reuse), atomic publish + .ready stamp, node-local bare clone for fast file:// submodule fetches, 14-day GC. prebuild is now matrix-discovery only.

Verified (run 27828830325): all 13 builds green; logs confirm exactly one job logged Populating and the other 12 Reusing cached for the same key on the same node — the flock arbitration works. This removes the last node-coupling, so dropping the nodeSelector (task 3) is now safe.

Validation status

• buildkit fix: all 13 builds pass live (run 27762128012 / 27795353512).
• round-trip: workflow_dispatch aggregate downloaded all kernels-*, combined, produced both tarballs; publish correctly skipped (run 27762128012).
• kernel-devel slimming: ~88% smaller, igloo_driver builds green (x86_64 + powerpc).
• node-agnostic sources: per-node flock cache verified (1 populate / 12 reuse, run 27828830325).
• (post-merge) downstream kube nodeSelector drop — now unblocked (prebuild→build coupling resolved by change 5).