ci(lesavka): use prebuilt media test image

Jenkinsfile

@@ -17,7 +17,7 @@ spec:
     node-role.kubernetes.io/worker: "true"
   containers:
     - name: rust-ci
-      image: rust:1.92-slim-bookworm
+      image: registry.bstein.dev/bstein/lesavka-ci@sha256:db682677e608ca029c0291ea1475ddefd40c5d17897306403278b4266908d0e6
       command: ["cat"]
       tty: true
       env:
@@ -85,33 +85,6 @@ spec:
         container('rust-ci') {
           sh '''
             set -eu
-            apt-get update
-            DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
-              python3 \
-              build-essential \
-              curl \
-              file \
-              git \
-              clang \
-              llvm \
-              pkg-config \
-              libssl-dev \
-              ca-certificates \
-              libgstreamer1.0-dev \
-              libgstreamer-plugins-base1.0-dev \
-              gstreamer1.0-tools \
-              gstreamer1.0-plugins-base \
-              gstreamer1.0-plugins-good \
-              gstreamer1.0-plugins-bad \
-              gstreamer1.0-plugins-ugly \
-              gstreamer1.0-libav \
-              protobuf-compiler \
-              libpango1.0-dev \
-              libcairo2-dev \
-              libgdk-pixbuf-2.0-dev \
-              libgtk-4-dev
-            rm -rf /var/lib/apt/lists/*
-            rustup component add rustfmt llvm-tools-preview clippy
             git config --global --add safe.directory "$WORKSPACE"
           '''
         }
@@ -127,33 +100,6 @@ spec:
           sh '''
             set -eu
 
-            apt-get update
-            DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
-              python3 \
-              build-essential \
-              curl \
-              file \
-              git \
-              clang \
-              llvm \
-              pkg-config \
-              libssl-dev \
-              ca-certificates \
-              libgstreamer1.0-dev \
-              libgstreamer-plugins-base1.0-dev \
-              gstreamer1.0-tools \
-              gstreamer1.0-plugins-base \
-              gstreamer1.0-plugins-good \
-              gstreamer1.0-plugins-bad \
-              gstreamer1.0-plugins-ugly \
-              gstreamer1.0-libav \
-              protobuf-compiler \
-              libpango1.0-dev \
-              libcairo2-dev \
-              libgdk-pixbuf-2.0-dev \
-              libgtk-4-dev
-            rm -rf /var/lib/apt/lists/*
-            rustup component add rustfmt llvm-tools-preview clippy
             git config --global --add safe.directory "$WORKSPACE"
 
             overall_rc=0

docker/ci.Dockerfile

@@ -0,0 +1,34 @@
+FROM rust:1.92-slim-bookworm
+
+LABEL org.opencontainers.image.source="https://scm.bstein.dev/bstein/lesavka"
+LABEL org.opencontainers.image.description="Lesavka Jenkins CI toolchain"
+
+RUN apt-get update \
+  && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    python3 \
+    build-essential \
+    curl \
+    file \
+    git \
+    clang \
+    llvm \
+    pkg-config \
+    libssl-dev \
+    ca-certificates \
+    libgstreamer1.0-dev \
+    libgstreamer-plugins-base1.0-dev \
+    gstreamer1.0-tools \
+    gstreamer1.0-plugins-base \
+    gstreamer1.0-plugins-good \
+    gstreamer1.0-plugins-bad \
+    gstreamer1.0-plugins-ugly \
+    gstreamer1.0-libav \
+    protobuf-compiler \
+    libpango1.0-dev \
+    libcairo2-dev \
+    libgdk-pixbuf-2.0-dev \
+    libgtk-4-dev \
+  && rm -rf /var/lib/apt/lists/*
+
+RUN rustup component add rustfmt llvm-tools-preview clippy \
+  && cargo install --locked cargo-llvm-cov

scripts/ci/hygiene_gate_baseline.json

@@ -983,7 +983,7 @@
     "server/src/bin/lesavka_uvc/coverage_model.rs": {
       "clippy_warnings": 0,
       "doc_debt": 0,
-      "loc": 286
+      "loc": 288
     },
     "server/src/bin/lesavka_uvc/coverage_startup.rs": {
       "clippy_warnings": 0,

server/src/tests/video.rs

@@ -139,8 +139,10 @@ fn pull_reencoded_frame_rgba(
         .end_of_stream()
         .map_err(|err| anyhow::anyhow!("eos failed: {err:?}"))?;
 
+    // ARM CI workers can take a while to complete the full 1080p double
+    // encode/decode probe; the assertion below still verifies the frame.
     let sample = appsink
-        .try_pull_sample(gst::ClockTime::from_seconds(5))
+        .try_pull_sample(gst::ClockTime::from_seconds(30))
         .ok_or_else(|| anyhow::anyhow!("timed out pulling reencoded frame"))?;
     let caps = sample
         .caps()