Pin platform 0.1.0 release and wire up automatic propagation

- parent/BOM now point at the immutable 0.1.0 release instead of a SNAPSHOT
- declare the Gitea Maven registry so Renovate can discover new platform versions
- renovate.json: group platform bumps into one automerged PR
- CI: drop --no-cache (releases are immutable, so caching is safe again) and add
  workflow_dispatch so rebuild-all-apps.sh can force an urgent rebuild

Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_01XXKjx7FNyRVAjU8dgB5KhN

.gitea/workflows/build.yml

@@ -2,6 +2,9 @@ name: build-and-publish
 on:
   push:
     branches: [main]
+  # Lets `rebuild-all-apps.sh` force a rebuild (e.g. to roll out an urgent platform fix immediately
+  # instead of waiting for a Renovate bump PR).
+  workflow_dispatch:
 
 jobs:
   build:
@@ -12,15 +15,15 @@ jobs:
       - name: Log in to the Gitea container registry
         run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.thebennett.net -u "${{ secrets.REGISTRY_USER }}" --password-stdin
 
-      # --no-cache: the platform is a 0.1.0-SNAPSHOT dependency, so a stale cached maven layer could bake
-      # in an old (e.g. unpatched) version. Always resolve fresh for a correct, scanned image.
+      # The platform is now referenced by an immutable RELEASE version, so a cached maven layer can't
+      # silently hold an old build — layer caching is safe again (and much faster).
       - name: Build image
         env:
           DOCKER_BUILDKIT: "1"
           MAVEN_USER: ${{ secrets.REGISTRY_USER }}
           MAVEN_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
-          docker build --no-cache \
+          docker build \
             --secret id=maven_user,env=MAVEN_USER \
             --secret id=maven_token,env=MAVEN_TOKEN \
             --build-arg GIT_SHA=${{ github.sha }} \