Bake git/yq/bash/python3/curl into a custom docker-cli image

Replaces per-build on-demand installs (apk add bash/python3/curl,
curl-downloading yq to /tmp) in runHooks.groovy, syncArgoApp.groovy,
and updateHelmTag.groovy with a single custom image
(build-tools.Dockerfile) that has all of it baked in once, at
image-build time — not repeated on every single pipeline run.

updateHelmTag.groovy also now runs inside container('docker-cli')
(previously unwrapped, defaulting to the auto-injected jnlp agent
container, which is why it needed the curl-downloaded yq fallback in
the first place — that container has git but not yq).

dind-pod.yaml's docker-cli container now points at
harbor.192.168.1.7.nip.io/homelab/build-tools:1 instead of the stock
docker:27-cli — this image needs building and pushing once before any
build using this pod template will work; see build-tools.Dockerfile's
header comment.

resources/org/homelab/build-tools.Dockerfile

@@ -0,0 +1,13 @@
+# Custom docker-cli image for dind-pod.yaml's docker-cli container —
+# bakes in everything the pipeline stages need at runtime (git, yq,
+# bash, python3 + pip/venv for runHooks' python hooks, curl) so nothing
+# gets apk-installed or curl-downloaded on every single build. Rebuild
+# and push this (see the one-off build commands in the commit that
+# added this file) whenever this list changes; dind-pod.yaml pins the
+# resulting image tag explicitly, so a rebuild doesn't silently roll
+# out until that pin is also bumped.
+FROM docker:27-cli
+
+RUN apk add --no-cache git bash python3 py3-pip py3-virtualenv curl \
+    && curl -sL -o /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 \
+    && chmod +x /usr/local/bin/yq

resources/org/homelab/dind-pod.yaml

@@ -33,7 +33,14 @@ spec:
         - name: docker-graph-storage
           mountPath: /var/lib/docker
     - name: docker-cli
-      image: docker:27-cli
+      # Custom image (see build-tools.Dockerfile in this same directory)
+      # — bakes in git/yq/bash/python3+pip/venv/curl so nothing needs
+      # apk-installing or curl-downloading on every single build (was
+      # slow and, per its own point, defeats the purpose of a
+      # reproducible pipeline to be quietly downloading a tool binary
+      # fresh on every run). Versioned tag, not :latest — a rebuild of
+      # the tools image doesn't roll out until this pin is bumped too.
+      image: harbor.192.168.1.7.nip.io/homelab/build-tools:1
       command: ["cat"]
       tty: true
       env: