Add local CI image build script and document bootstrap flow.

Co-authored-by: Cursor <[email protected]>

docs/ci-image.md

@@ -118,14 +118,48 @@ After label changes, roll runner pods so they re-register with Gitea.
 1. Ensure homelab-platform runners have `gitea-registry-dockerconfig` and the
    `python-repositories-ci` label (see homelab-platform docs).
 2. Merge `ci-image.yml`, `docker/ci/Dockerfile`, and workflow migrations to `main`.
-3. Run **Build CI Image** manually once (Actions → Build CI Image → Run workflow).
+3. Seed the registry with a first image (see below).
 4. Confirm a test workflow job starts on `python-repositories-ci`.
 
 Until step 3 completes, jobs targeting `python-repositories-ci` will fail because
 the image does not exist in the Gitea registry yet.
 
+### Seed the image
+
+**After merge to `main`:** Actions → **Build CI Image** → **Run workflow**.
+
+**Before merge (e.g. PR branch):** the workflow file is not on `main` yet — build
+and push locally with [`scripts/ci/build-ci-image.sh`](../scripts/ci/build-ci-image.sh):
+
+```bash
+export CI_RUNNER_TOKEN='ci-bot-personal-access-token'
+bash scripts/ci/build-ci-image.sh --push
+```
+
+Run from the repo root on the branch you want to test. Runners pull
+`gitea.lille-vemmelund.dk/brian/python-repositories-ci:latest` from the registry;
+they do not care which git branch built it.
+
+Override registry settings if needed:
+
+```bash
+export REGISTRY=gitea.lille-vemmelund.dk
+export REGISTRY_USER=ci-bot
+export CI_RUNNER_TOKEN='...'
+bash scripts/ci/build-ci-image.sh --push
+```
+
 ## Local build
 
+Build only (no registry login or push):
+
+```bash
+export CI_RUNNER_TOKEN='ci-bot-personal-access-token'
+bash scripts/ci/build-ci-image.sh --local
+```
+
+Or manually:
+
 ```bash
 echo "$CI_RUNNER_TOKEN" > /tmp/uv_token
 docker build -f docker/ci/Dockerfile \