images: add custom image which packages SOPS. update renovate and add publishing workflow

images/act/Dockerfile

@@ -0,0 +1,15 @@
+FROM docker.gitea.com/runner-images:ubuntu-latest
+
+## renovate: datasource=github-releases depName=getsops/sops
+ARG SOPS_VERSION=v3.13.3
+
+RUN set -eux; \
+    arch=$(dpkg --print-architecture); \
+    asset="sops-${SOPS_VERSION}.linux.${arch}"; \
+    url="https://github.com/getsops/sops/releases/download/${SOPS_VERSION}"; \
+    curl -fsSL -o "/tmp/$asset" "$url/$asset"; \
+    curl -fsSL -o /tmp/checksums.txt "$url/sops-${SOPS_VERSION}.checksums.txt"; \
+    (cd /tmp && grep " ${asset}$" checksums.txt | sha256sum -c -); \
+    install -m 0755 "/tmp/$asset" /usr/local/bin/sops; \
+    rm -f "/tmp/$asset" /tmp/checksums.txt; \
+    sops --version

images/act/README.md

@@ -0,0 +1,5 @@
+# act runner image
+
+Gitea / Forgejo Actions runner image based on `runner-images:ubuntu-latest` with the pinned, checksum-verified SOPS build installed.
+
+Built and pushed to `git.studiovita.li/studio/actions:ubuntu-latest` by the `build` workflow on push to `main`. Update `SOPS_VERSION` in `Dockerfile` to bump SOPS (tracked in renovate.json).