feat(builder): research, build and a worker for the AI builder on our own hardware

- research: searches SearXNG, reads the best pages through the reader, has the
  model list the server's variants, then checks every Docker image and Steam
  app it named for real before an admin sees it.
- build: first boot of the variant's images (skipping ones that need root),
  a draft by the model, then the draft deployed with the node-agent's
  BootTest like CI does; crashes, error lines and saves outside /server go
  back to the model, three boots at most.
- worker: polls the panel's builder queue (outbound only), runs research or
  build in a fresh clone, streams the output as the job log, and opens the
  result as a pull request from gbr-bot.
- Dockerfile.builder, a workflow publishing gbr-builder:latest, compose and
  env files for the builder VM, and BUILDER.md.

draft now keeps its conversation in a drafter, so build can send boot
failures back to the same model session.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile.builder

@@ -0,0 +1,14 @@
+# The AI builder worker (gbrgames worker), run on our own builder VM; see BUILDER.md.
+FROM golang:1.24-alpine AS build
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY cmd ./cmd
+RUN CGO_ENABLED=0 go build -o /gbrgames ./cmd/gbrgames
+
+FROM alpine:3.22
+# docker CLI for first boots and boot tests (through the host's socket), git to clone and open PRs
+RUN apk add --no-cache docker-cli git ca-certificates
+COPY --from=build /gbrgames /usr/local/bin/gbrgames
+WORKDIR /work
+ENTRYPOINT ["gbrgames", "worker"]