fix: update validate.yml for split-base Dockerfiles

Replace single-Dockerfile build with two-step: build Dockerfile.base
first (loads as opencode-devbox:validate-base), then build
Dockerfile.variant with BASE_IMAGE pointing at the local base image.
All four validate jobs updated.

.gitea/workflows/validate.yml

@@ -79,13 +79,26 @@ jobs:
         with:
           driver-opts: network=host
 
+      - name: Build base layer (amd64, load to local daemon)
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: Dockerfile.base
+          platforms: linux/amd64
+          push: false
+          load: true
+          tags: opencode-devbox:validate-base
+
       - name: Build base image (amd64, load to local daemon)
         uses: docker/build-push-action@v7
         with:
           context: .
+          file: Dockerfile.variant
           platforms: linux/amd64
           push: false
           load: true
+          build-args: |
+            BASE_IMAGE=opencode-devbox:validate-base
           tags: opencode-devbox:ci-base
 
       - name: Smoke test
@@ -133,14 +146,26 @@ jobs:
         with:
           driver-opts: network=host
 
+      - name: Build base layer (amd64, load to local daemon)
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: Dockerfile.base
+          platforms: linux/amd64
+          push: false
+          load: true
+          tags: opencode-devbox:validate-base
+
       - name: Build omos image (amd64, load to local daemon)
         uses: docker/build-push-action@v7
         with:
           context: .
+          file: Dockerfile.variant
           platforms: linux/amd64
           push: false
           load: true
           build-args: |
+            BASE_IMAGE=opencode-devbox:validate-base
             INSTALL_OMOS=true
           tags: opencode-devbox:ci-omos
 
@@ -189,14 +214,26 @@ jobs:
         with:
           driver-opts: network=host
 
+      - name: Build base layer (amd64, load to local daemon)
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: Dockerfile.base
+          platforms: linux/amd64
+          push: false
+          load: true
+          tags: opencode-devbox:validate-base
+
       - name: Build with-pi image (amd64, load to local daemon)
         uses: docker/build-push-action@v7
         with:
           context: .
+          file: Dockerfile.variant
           platforms: linux/amd64
           push: false
           load: true
           build-args: |
+            BASE_IMAGE=opencode-devbox:validate-base
             INSTALL_PI=true
           tags: opencode-devbox:ci-with-pi
 
@@ -245,14 +282,26 @@ jobs:
         with:
           driver-opts: network=host
 
+      - name: Build base layer (amd64, load to local daemon)
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: Dockerfile.base
+          platforms: linux/amd64
+          push: false
+          load: true
+          tags: opencode-devbox:validate-base
+
       - name: Build omos+with-pi image (amd64, load to local daemon)
         uses: docker/build-push-action@v7
         with:
           context: .
+          file: Dockerfile.variant
           platforms: linux/amd64
           push: false
           load: true
           build-args: |
+            BASE_IMAGE=opencode-devbox:validate-base
             INSTALL_OMOS=true
             INSTALL_PI=true
           tags: opencode-devbox:ci-omos-with-pi