The self-tests, the build-isolation fixture and the three tracker
workflows pulled archlinux:base-devel from Docker Hub without logging
in. On 2026-10-09 that failed two jobs on one pull request: one with
'toomanyrequests', one with a 504 from Docker Hub's token endpoint.
Arch publishes the same image as ghcr.io/archlinux/archlinux, which
GitHub's runners pull without that limit.
Recreate pacman's local signing key before upgrading packages so keyring install scripts can sign trusted keys. Keep the key out of the builder image and exercise keyring population with a keyless test image.