Fix the builder image workflow before it is ever activated

Smoke-test the tag the run actually pushed. It tested :latest, which
metadata-action only emits on the default branch, so a tag-triggered or
manual run would have failed against an image that does not exist. Also
assert HUGO_CACHEDIR, working directory and uid, since all three are set in
the Dockerfile specifically to override upstream defaults and nothing else
would catch a regression.

Bump build-push-action to v6 and add setup-buildx-action, matching
vfb-status and vfbquery, which already publish into the virtualflybrain
namespace with the same org secrets.

Make the header say plainly that the image does not exist until this file is
moved into .github/workflows/, and correct the description of
Robbie1977/docsy-builder: it is a copy of docsy-example rather than a fork,
and the Dockerfile on the branch that built the live image is
floryn90/hugo:ext-alpine, not klakegg.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X1AuLA5tHPwpD7Hp5utPkS

Author: Robbie1977

themes/vfb-nova/ci/builder-image.yml

@@ -2,16 +2,20 @@
 #   git mv themes/vfb-nova/ci/builder-image.yml .github/workflows/builder-image.yml
 # Parked here because the token used to push this branch has no `workflow`
 # scope, and GitHub rejects any push touching .github/workflows/ without it.
+# Pushing from a checkout with normal credentials has no such problem.
 #
-# Publishes the image the Rancher `hugo` service runs. It lives here, next to
-# the site it builds, rather than in Robbie1977/docsy-builder — that repo is a
-# fork of docsy-example whose only functional content is a two-line Dockerfile
-# (klakegg/hugo + git); everything else in it is Docsy's demo content. Once
-# Docsy is gone the name is wrong and the demo content is dead weight, so it
-# should be retired rather than rewritten.
+# Until it is moved, virtualflybrain/vfb-static-builder DOES NOT EXIST and the
+# Rancher service has nothing to pull. This has to happen before the switchover.
+#
+# Publishes the image the Rancher build service runs. It lives here, next to
+# deploy.sh, because deploy.sh is what dictates the image's contents — bash,
+# rsync and findutils are in the Dockerfile for its sake. Splitting the two
+# across repos is how rcourt/docsy-builder:Feb2023 ended up frozen on a floating
+# base tag for two years.
 #
 # Uses the org-level Docker Hub secrets (DOCKER_HUB_USER / DOCKER_HUB_PASSWORD),
-# same as the other VirtualFlyBrain workflows.
+# which vfb-status and vfbquery already use to publish into the virtualflybrain
+# namespace. Docker Hub creates the repository on first push.
 name: builder image
 
 on:
@@ -34,6 +38,8 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - uses: docker/setup-buildx-action@v3
+
       - name: Log in to Docker Hub
         uses: docker/login-action@v3
         with:
@@ -51,15 +57,34 @@ jobs:
             type=sha,format=short
 
       - name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: .
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
 
+      # Tests the first tag this run actually pushed. The previous version
+      # tested :latest, which metadata-action only emits on the default branch,
+      # so a tag-triggered run would have failed on an image that did not exist.
+      #
+      # Pin the Rancher service to the sha- tag printed at the end, not :latest.
       - name: Smoke test the published image
+        env:
+          TAGS: ${{ steps.meta.outputs.tags }}
         run: |
-          docker run --rm virtualflybrain/vfb-static-builder:latest hugo version
-          docker run --rm --entrypoint /bin/sh virtualflybrain/vfb-static-builder:latest \
-            -c 'command -v rsync && command -v bash && command -v find'
+          set -euo pipefail
+          image=$(printf '%s\n' "$TAGS" | head -n1)
+          echo "testing $image"
+          docker run --rm --entrypoint hugo "$image" version
+          docker run --rm --entrypoint /bin/sh "$image" -c '
+            set -e
+            command -v bash
+            command -v rsync
+            command -v find
+            test "$HUGO_CACHEDIR" = /tmp/hugo_cache
+            test "$(pwd)" = /src
+            test "$(id -u)" = 0
+          '
+          echo "pushed tags:"
+          printf '%s\n' "$TAGS"