Add QuickStack runner job image

runner-images/quickstack-job/.dockerignore

@@ -0,0 +1,2 @@
+*
+!Dockerfile

runner-images/quickstack-job/Dockerfile

@@ -0,0 +1,27 @@
+FROM docker:27.5.1-cli AS docker-cli
+
+FROM docker.gitea.com/runner-images:ubuntu-latest-slim
+
+USER root
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+COPY --from=docker-cli /usr/local/bin/docker /usr/local/bin/docker
+COPY --from=docker-cli /usr/local/libexec/docker/cli-plugins/docker-buildx /usr/local/libexec/docker/cli-plugins/docker-buildx
+
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    curl \
+    git \
+    jq \
+    openssh-client \
+    zstd \
+  && rm -rf /var/lib/apt/lists/*
+
+RUN node --version \
+  && git --version \
+  && docker --version \
+  && docker buildx version \
+  && jq --version \
+  && zstd --version

runner-images/quickstack-job/README.md

@@ -0,0 +1,29 @@
+# QuickStack Job Runner Image
+
+This image is the small, source-controlled job container used by the Nuvisphere
+Gitea runners for `ubuntu-latest`, `ubuntu-24.04` and `ubuntu-22.04` jobs.
+
+It replaces `docker.gitea.com/runner-images:ubuntu-latest` for QuickStack
+workloads. The full upstream image is large and has caused slow or stuck pulls
+on production runners. This image starts from Gitea's slim Node runner image
+and adds only the tools required by the shared QuickStack OCI workflow:
+
+- Docker CLI and Buildx
+- Git
+- curl
+- jq
+- OpenSSH client
+- CA certificates
+- zstd
+
+The stable production tag is:
+
+```text
+gitea.nuvisphere.de/nuvisphere/quickstack-job:node20-docker27
+```
+
+The publish workflow also pushes an immutable commit tag:
+
+```text
+gitea.nuvisphere.de/nuvisphere/quickstack-job:sha-<commit>
+```