add DocuSeal to GKE — manifests, Terraform, Argo CD app; update ci-base Dockerfile

servers/legion/k8s/gitea-runner/Dockerfile

@@ -6,7 +6,7 @@ ENV DEBIAN_FRONTEND=noninteractive
 
 COPY --from=runner-bin /bin/forgejo-runner /usr/local/bin/act_runner
 
-# Core system tools
+# Core system tools + C build deps needed by El compiler and other CI jobs
 RUN apt-get update && apt-get install -y --no-install-recommends \
     ca-certificates \
     curl \
@@ -27,8 +27,19 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     pkg-config \
     software-properties-common \
     zstd \
+    sudo \
+    libcurl4-openssl-dev \
+    libssl-dev \
+    libsqlite3-dev \
+    libpq-dev \
+    libffi-dev \
+    zlib1g-dev \
+    dpkg-dev \
     && rm -rf /var/lib/apt/lists/*
 
+# Allow any user to run sudo without a password (CI containers need apt-get etc.)
+RUN echo "ALL ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers
+
 # Node.js 20 LTS via binary tarball (nodesource apt repo is unreliable on Ubuntu 24.04)
 RUN NODE_VERSION=20.19.1 \
     && curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz" \