feat(builder): research, build and a worker for the AI builder on our own hardware

- research: searches SearXNG, reads the best pages through the reader, has the
  model list the server's variants, then checks every Docker image and Steam
  app it named for real before an admin sees it.
- build: first boot of the variant's images (skipping ones that need root),
  a draft by the model, then the draft deployed with the node-agent's
  BootTest like CI does; crashes, error lines and saves outside /server go
  back to the model, three boots at most.
- worker: polls the panel's builder queue (outbound only), runs research or
  build in a fresh clone, streams the output as the job log, and opens the
  result as a pull request from gbr-bot.
- Dockerfile.builder, a workflow publishing gbr-builder:latest, compose and
  env files for the builder VM, and BUILDER.md.

draft now keeps its conversation in a drafter, so build can send boot
failures back to the same model session.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/builder/docker-compose.yml

@@ -0,0 +1,28 @@
+# The AI builder worker on the builder VM (BUILDER.md). It polls the panel for jobs, so nothing needs to
+# reach this VM from outside. Game servers it boots run in the isolated gbr-boottest network.
+services:
+  gbr-builder:
+    image: www.gitea.gbreed.com/gbreed-public/gbr-builder:latest
+    container_name: gbr-builder
+    restart: unless-stopped
+    env_file: .env
+    environment:
+      WORK_DIR: /work
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      # Job clones and first-boot reports (servers themselves use Docker volumes)
+      - /opt/gbr-builder/work:/work
+    labels:
+      - com.centurylinklabs.watchtower.enable=true
+
+  watchtower:
+    image: containrrr/watchtower:1.7.1
+    container_name: gbr-builder-watchtower
+    restart: unless-stopped
+    environment:
+      WATCHTOWER_LABEL_ENABLE: "true"
+      WATCHTOWER_POLL_INTERVAL: "300"
+      WATCHTOWER_CLEANUP: "true"
+      DOCKER_API_VERSION: "1.44"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock

scripts/builder/env.example

@@ -0,0 +1,19 @@
+# Copy to /opt/gbr-builder/.env and fill in. Never commit the real file.
+
+# The panel the worker takes jobs from, and the token both sides share (panel env BUILDER_TOKEN)
+PANEL_URL=https://api.gbrhosting.com
+BUILDER_TOKEN=
+
+# The gbr-bot account's token (repository read/write on gbreed-public/gbr-games): pushes draft branches, opens PRs
+GITEA_TOKEN=
+
+# The model on the 3090, and the search + page reader the research step uses
+OLLAMA_URL=http://192.168.4.30:11434
+SEARXNG_URL=http://192.168.4.38:8080
+READER_URL=http://192.168.4.38:3000
+
+# Optional
+# MODEL=qwen3.8:27b
+# MODEL_PROVIDER=ollama        # or gemini, with GEMINI_API_KEY
+# POLL_INTERVAL=20s
+# WORKER_NAME=gamebuilder