CI: jobs run in a container, PlatformIO directly in it, the toolchains in a volume

The runner now gives each job a container. The workflow asks for
python:3.12-slim, installs git, a compiler and PlatformIO, and mounts the
roro9stack-pio volume as the cache; the scripts skip their own docker run
when RORO_NO_DOCKER says they're in the build container already. A tag
from before the framework was rebuilt gets the stock framework libraries
back before it builds.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT

scripts/release_build.sh

@@ -21,7 +21,12 @@ git -C "$SRC" describe --tags --exact-match >/dev/null 2>&1 || { echo "release:
 source "$TOOLS/_docker.sh"
 ROOT="$SRC"  # _docker.sh mounts $ROOT as /work: the checkout to build, not necessarily this copy
 DOCKER_EXTRA=()
-run_in_container bash -c 'git config --global --add safe.directory /work && pio run -e cardputer-adv'
+# A tag from before the framework was rebuilt with our settings (ADR 0006) can't link against a
+# rebuilt one left in the toolchain cache: it gets the framework's libraries as they come.
+if ! grep -q custom_sdkconfig "$SRC/platformio.ini"; then
+    run_in_container bash -c 'rm -rf "${PLATFORMIO_CORE_DIR:-/pio}/packages/framework-arduinoespressif32-libs"'
+fi
+run_in_container bash -c 'git config --global --add safe.directory "$PWD" && pio run -e cardputer-adv'
 
 BUILD="$SRC/.pio/build/cardputer-adv"
 NAME="roro9stack-$VERSION"