Replaces dockerTools.streamLayeredImage (no .copyTo) with nix2container
buildImage so angie consumes the shared parity-lib mkNix2ContainerPublish
(stage/publish/publish-index/push-staged/verify-digest) instead of inline
skopeo/token/guard. Image content preserved (angie + conf-dir + runtime dirs,
runs as root); .woodpecker.yaml thinned to nix run .#publish. Tags move from
:latest-arm64 to :<ver>-arm64 + index :<ver>/:latest (no consumer pinned
:latest-arm64). pipeline-doctor --strict 9/9.
Builds via dockerTools.streamLayeredImage from nixpkgs unstable's
pkgs.angie. Woodpecker pipeline pushes to git.oleks.space/oleks/angie
with both <version>-arm64 and latest-arm64 tags. Used by the
kotkanagrilli.fi staging Helm chart on the kotkan node (arm64) to
replace the upstream amd64-only runalsh/angie image.
Oleks