Fix the real cause of slow podman deploys: add --build, drop podman rmi

podman-compose@.service was missing the --build flag that
docker-compose@.service already has (added on cube.local:
/etc/systemd/system/podman-compose@.service), so removing
maptool:latest before every restart (my own earlier fix, meant to
force a rebuild) also destroyed the build cache along with it - every
deploy was redoing apt-get/bundle install from scratch (~3 min
measured, vs ~20s before). --build lets a plain systemctl restart
rebuild while still reusing unchanged layers, same as docker did, so
the ci.yml deploy step collapses back to one line.

.gitea/workflows/ci.yml

@@ -99,19 +99,13 @@ jobs:
 
       # podman-compose@maptool.service (/etc/systemd/system/podman-compose@.service)
       # owns the container lifecycle — its ExecStartPre already tears down
-      # the previous containers/networks/volumes on every start, but not
-      # the built image, and its ExecStart runs a plain `podman compose up`
-      # (deliberately no `--build`), which only builds when the image tag
-      # isn't already present locally. So a bare restart would just
-      # relaunch the previous image; removing that tag first forces a
-      # fresh build from the code just synced above — purely local, no
-      # registry involved (same `maptool:latest` docker-compose.yaml
-      # already builds/tags; podman rmi never talks to a registry for a
-      # locally-built image). sudo is needed since the unit — and thus the
-      # image — is root's, not gitea-runner's own (gitea-runner has
-      # passwordless sudo for this on cube-host).
+      # the previous containers/networks/volumes on every start, and its
+      # ExecStart runs `podman compose up --build` (mirroring
+      # docker-compose@.service's own `--build`), so a plain restart always
+      # picks up the code just synced above while still reusing unchanged
+      # layers (apt-get/bundle install) as cache — unlike explicitly
+      # removing the image first, which would delete that cache along with
+      # it. sudo is needed since the unit is root's, not gitea-runner's own
+      # (gitea-runner has passwordless sudo for this on cube-host).
       - name: Deploy
-        run: |
-          sudo systemctl stop podman-compose@maptool.service
-          sudo podman rmi -f maptool:latest || true
-          sudo systemctl start podman-compose@maptool.service
+        run: sudo systemctl restart podman-compose@maptool.service