GRM-97: ci: use pre-built tier images for all CI workflows

Makefile

@@ -1,4 +1,4 @@
-.PHONY: all setup setup-ci setup-quality setup-molecule setup-release install update lint ansible-lint makefile-lint lint-all lint-ruff lint-format lint-bandit lint-deps typecheck checkmake install-hooks test test-unit pytest-cov molecule molecule-all test-all clean workflow-lint workflow-dryrun workflow-check install-tools
+.PHONY: all setup setup-ci setup-quality setup-molecule setup-release setup-image install update lint ansible-lint makefile-lint lint-all lint-ruff lint-format lint-bandit lint-deps typecheck checkmake install-hooks test test-unit pytest-cov molecule molecule-all test-all clean workflow-lint workflow-dryrun workflow-check install-tools
 .PHONY: configure-gitea-pypi
 .PHONY: create-task create-pr push-with-pr git-push
 
@@ -62,6 +62,14 @@ setup-release: $(VENV)/bin/activate .env configure-gitea-pypi
 	@export PATH="$(HOME)/.local/bin:$$PATH"; \
 	$(BIN)/python -m devx.tools.setup --bin "$(BIN)" --skip-install --no-ansible-collections --no-pre-commit
 
+# Setup for pre-built image jobs (deps already in image, just link venv + install project)
+# Usage: make setup-image              (runtime deps only)
+#        make setup-image EXTRAS=lint  (runtime + lint deps, e.g. ansible-lint)
+#        make setup-image EXTRAS=ci,lint (runtime + ci + lint deps)
+setup-image:
+	@if [ -d /opt/venv ]; then ln -sf /opt/venv .venv; . .venv/bin/activate && pip install -e .$(if $(EXTRAS),[$(EXTRAS)],) 2>/dev/null; \
+	else echo "[setup-image] /opt/venv not found — falling back to setup-ci"; $(MAKE) setup-ci; fi
+
 # Helper: run pip install with Gitea registry configured
 # Usage: $(PIP_INSTALL) install -e '.[ci,lint]'
 PIP_INSTALL := if [ -z "$$REPO_TOKEN" ]; then . ./.env 2>/dev/null; fi; \