ci: convert workflows to use composite actions

Replace inline setup-env, notify-failure, and quality-checks steps in
ci.yml, post-merge.yml, and build-images.yml with composite action
references. Also fix pre-existing make workflow-dryrun failure by
using env context instead of vars/secrets in container.credentials
(act_runner dry-run does not populate vars/secrets contexts).

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.gitea/workflows/build-images.yml

@@ -29,14 +29,20 @@ concurrency:
   group: build-images
   cancel-in-progress: false
 
+env:
+  PIP_BREAK_SYSTEM_PACKAGES: "1"
+  PYTHONPATH: src
+  CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
+  CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
+
 jobs:
   build-and-push:
     runs-on: docker
     container:
       image: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-full:latest
       credentials:
-        username: ${{ vars.CI_GITEA_USERNAME }}
-        password: ${{ secrets.CI_GITEA_API_TOKEN }}
+        username: ${{ env.CI_GITEA_USERNAME }}
+        password: ${{ env.CI_GITEA_API_TOKEN }}
     timeout-minutes: 30
     outputs:
       is-release: ${{ steps.check.outputs.is-release }}
@@ -101,20 +107,9 @@ jobs:
             --tag latest \
             --registry git.oblachno.oblachno.fyi \
             --push
-      - name: Notify on failure
-        if: failure()
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-          PYTHONPATH: src
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          export PATH="$HOME/.local/bin:$PATH"
-          python3 -m devx.ci.notify_failure \
-            --repo "${{ github.repository }}" \
-            --run-id "${{ github.run_id }}" \
-            --workflow "build-images/build-and-push" \
-            --commit "${{ github.sha }}" \
-            --auto-login
+      - uses: ./.gitea/actions/notify-failure
+        with:
+          workflow: "build-images/build-and-push"
 
   cleanup:
     needs: [build-and-push]
@@ -123,8 +118,8 @@ jobs:
     container:
       image: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-base:latest
       credentials:
-        username: ${{ vars.CI_GITEA_USERNAME }}
-        password: ${{ secrets.CI_GITEA_API_TOKEN }}
+        username: ${{ env.CI_GITEA_USERNAME }}
+        password: ${{ env.CI_GITEA_API_TOKEN }}
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4