publish: force gzip on every layer so no blob exceeds Cloudflare's 100 MB

bitnami/minideb ships its base layer as an uncompressed 133 MB tar; with
the containerd image store docker push sends it as-is and Cloudflare in
front of Gitea answers 413. Build with force-compression=true (base layer
becomes ~43 MB) and document why.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

scripts/build-and-publish-unraid.sh

@@ -109,7 +109,13 @@ COMMIT_TIME="$(git log -1 --format=%cI)"
 # architecture-neutral); only the jlink and runtime stages run under emulation
 # when cross-building linux/amd64 on an arm64 host. BUILD_TIMESTAMP pins the
 # JAR's reproducible-build timestamp to the commit, as upstream's CI does.
-docker build \
+#
+# force-compression matters: bitnami/minideb publishes its base layer as an
+# UNCOMPRESSED 133 MB tar, a daemon with the containerd image store pushes
+# blobs exactly as stored, and Gitea sits behind Cloudflare, which rejects any
+# request body over 100 MB with a 413. Recompressing every layer with gzip
+# brings that layer to ~43 MB; no layer of this image is then over 100 MB.
+docker buildx build \
     --pull \
     --platform "$PLATFORM" \
     --provenance=false --sbom=false \
@@ -118,6 +124,7 @@ docker build \
     --build-arg "BUILD_TIMESTAMP=$COMMIT_TIME" \
     --tag "$FULL_TAG" \
     --tag "$LATEST_TAG" \
+    --output type=docker,compression=gzip,force-compression=true \
     .
 
 # Step 3: registry auth, written straight into the private config (see above).