build.sh: first runnable revision

Learned from the pmbootstrap 3.11 source: aports overlays must replace
upstream dirs in one tree (duplicate pkgnames are a hard error), pmbootstrap
refuses root (drop to a sudo-capable build user), and export symlinks are
boot.img + fairphone-fp6.img. Stage 1 builds without imsd until the v0.3.0
tag exists. Temporary push trigger for bring-up.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.forgejo/workflows/build.yml

@@ -10,7 +10,10 @@ name: image
 
 on:
   workflow_dispatch:
-  # Enable after the pipeline is validated end-to-end:
+  # push trigger is temporary, for pipeline bring-up; narrow to
+  # workflow_dispatch + a nightly schedule once the pipeline is green:
+  push:
+    branches: [main]
   # schedule:
   #   - cron: '30 3 * * *'