Bake git/yq/bash/python3/curl into a custom docker-cli image

Replaces per-build on-demand installs (apk add bash/python3/curl,
curl-downloading yq to /tmp) in runHooks.groovy, syncArgoApp.groovy,
and updateHelmTag.groovy with a single custom image
(build-tools.Dockerfile) that has all of it baked in once, at
image-build time — not repeated on every single pipeline run.

updateHelmTag.groovy also now runs inside container('docker-cli')
(previously unwrapped, defaulting to the auto-injected jnlp agent
container, which is why it needed the curl-downloaded yq fallback in
the first place — that container has git but not yq).

dind-pod.yaml's docker-cli container now points at
harbor.192.168.1.7.nip.io/homelab/build-tools:1 instead of the stock
docker:27-cli — this image needs building and pushing once before any
build using this pod template will work; see build-tools.Dockerfile's
header comment.

resources/org/homelab/build-tools.Dockerfile

@@ -0,0 +1,13 @@
+# Custom docker-cli image for dind-pod.yaml's docker-cli container —
+# bakes in everything the pipeline stages need at runtime (git, yq,
+# bash, python3 + pip/venv for runHooks' python hooks, curl) so nothing
+# gets apk-installed or curl-downloaded on every single build. Rebuild
+# and push this (see the one-off build commands in the commit that
+# added this file) whenever this list changes; dind-pod.yaml pins the
+# resulting image tag explicitly, so a rebuild doesn't silently roll
+# out until that pin is also bumped.
+FROM docker:27-cli
+
+RUN apk add --no-cache git bash python3 py3-pip py3-virtualenv curl \
+    && curl -sL -o /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 \
+    && chmod +x /usr/local/bin/yq