ci: wire up the builder-image workflow and fix repo layout

The repo was committed with the CI files misnamed/misplaced, so nothing
ran. Move them into place and fix the issues that surfaced against the
Syrinx reference and the Dade target:

- Dockerfile.yml -> Dockerfile (the workflow references ./Dockerfile)
- builder-image.yml -> .gitea/workflows/builder-image.yml (Gitea only
  runs files under .gitea/workflows)
- build.yml -> templates/build.yml (it's the app-repo template, not a
  workflow for this repo; keep it out of the run path)
- runs-on [self-hosted, arm64] -> ubuntu-24.04-arm64 (the real Gitea
  label, matching Syrinx) in the workflow, template, and README
- bump image SDK android-35/build-tools 35.0.0 -> android-36/36.0.0 to
  match Dade's compileSdk 36 (avoids a job-time SDK download)
- template upload-artifact@v4 -> @v3 (v4 is unsupported on Gitea)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,48 @@
+# Native linux/arm64 Android build toolchain for CI.
+# Builds release artifacts only — no emulator, no test/system images.
+# eclipse-temurin publishes a native linux/arm64 manifest, so this runs
+# without emulation on an OCI Ampere (aarch64) runner.
+FROM eclipse-temurin:21-jdk-noble
+
+# --- Version pins (bump deliberately; this is what your app repos trust) ---
+# cmdline-tools: find the current build number at
+#   https://developer.android.com/studio#command-line-tools-only
+ARG CMDLINE_TOOLS_VERSION=13114758
+ARG BUILD_TOOLS_VERSION=36.0.0
+ARG PLATFORM_VERSION=android-36
+
+ENV ANDROID_SDK_ROOT=/opt/android-sdk \
+    ANDROID_HOME=/opt/android-sdk \
+    DEBIAN_FRONTEND=noninteractive
+
+# git is needed by some Gradle plugins; unzip/curl for SDK install.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        curl unzip git ca-certificates && \
+    rm -rf /var/lib/apt/lists/*
+
+# Install the command-line tools into the canonical "latest" location.
+RUN mkdir -p ${ANDROID_SDK_ROOT}/cmdline-tools && \
+    curl -fsSL -o /tmp/tools.zip \
+      "https://dl.google.com/android/repository/commandlinetools-linux-${CMDLINE_TOOLS_VERSION}_latest.zip" && \
+    unzip -q /tmp/tools.zip -d ${ANDROID_SDK_ROOT}/cmdline-tools && \
+    mv ${ANDROID_SDK_ROOT}/cmdline-tools/cmdline-tools ${ANDROID_SDK_ROOT}/cmdline-tools/latest && \
+    rm /tmp/tools.zip
+
+ENV PATH=${PATH}:${ANDROID_SDK_ROOT}/cmdline-tools/latest/bin:${ANDROID_SDK_ROOT}/platform-tools
+
+# Accept licenses and bake the SDK packages into the image so prod builds
+# don't depend on Google's endpoint at job time.
+# aapt2 and the build-tools binaries ship native arm64 for 35.x, so APK/AAB
+# packaging runs natively on aarch64.
+RUN yes | sdkmanager --licenses >/dev/null && \
+    sdkmanager --install \
+      "platform-tools" \
+      "platforms;${PLATFORM_VERSION}" \
+      "build-tools;${BUILD_TOOLS_VERSION}" && \
+    rm -rf ${ANDROID_SDK_ROOT}/.android
+
+# Sanity: fail the image build if the toolchain isn't actually usable.
+RUN java -version && sdkmanager --version && \
+    test -d "${ANDROID_SDK_ROOT}/platforms/${PLATFORM_VERSION}"
+
+WORKDIR /workspace