ci: build images one at a time

`image (api)` and `image (reconciler)` both died in run #13 with:

    ERROR: failed to solve: DeadlineExceeded: no active session for
    ylux5s1p4xyb5e5tmnz4gljhq: context deadline exceeded

That is the buildkit session heartbeat between buildx in the job container and
buildkitd in the dind sidecar, not anything in the Dockerfiles. The runner has
capacity 2, so two legs of the matrix built concurrently on a 2-core burstable
node already sitting at 81% CPU and 87% memory, and starved each other.

The evidence is in the same run: `image (worker)` was still building when the
other two failed, had the node to itself afterwards, and went green on an
unchanged Dockerfile.

max-parallel: 1 trades wall-clock for builds that finish. Every other gate in
run #13 — lint, types, unit, integration, security, dockerfile, chart — was
already green, so this is the last thing standing between here and a full run.

.gitea/workflows/ci.yaml

@@ -311,6 +311,20 @@ jobs:
       contents: read
     strategy:
       fail-fast: false
+      # One image at a time. The runner has capacity 2, so without this two buildx builds
+      # run concurrently on a 2-core burstable node that already sits near 80% CPU. Both
+      # then died with:
+      #
+      #   ERROR: failed to solve: DeadlineExceeded: no active session for <id>:
+      #   context deadline exceeded
+      #
+      # That is the buildkit session heartbeat between buildx in the job container and
+      # buildkitd in the dind sidecar missing its deadline under CPU starvation — not a
+      # Dockerfile problem. The third leg, which had the node to itself, kept building.
+      #
+      # Serial costs wall-clock and buys builds that finish. Raise it when the runner has
+      # cores to spare, not before.
+      max-parallel: 1
       matrix:
         svc: [api, worker, reconciler]
     # Deliberately no `outputs:` here. Matrix legs share one outputs map and clobber each