ci: run client builds on a Java 25 build agent instead of the controller

The toolchain image becomes a Jenkins inbound agent (jenkins/inbound-agent,
Java 25) labelled dorknet-builder. Jenkins itself stays on the stock image
and runs no builds, which also clears the built-in-node warning.

- Dockerfile: inbound-agent base; restic cache on the agent's own volume
- docker-compose.yml: the agent as a Coolify Docker Compose application,
  reaching Jenkins over WebSocket on the predefined Coolify network
- Jenkinsfile: agent { label 'dorknet-builder' }
- README: Java 25 for both sides (Java 21 support ends Sep 2027, Java 17
  is unsupported), restart policy, node setup and Coolify deployment

ci/jenkins/README.md

@@ -3,12 +3,13 @@
 The `Jenkinsfile` at the repo root builds the DorkNet clients on your existing
 Jenkins.
 
-It runs right on the Jenkins container, so that container's image needs the
-build toolchain: Python with LIEF, the .NET SDK, the Android NDK and build-tools,
-apktool, restic and rclone. `ci/jenkins/Dockerfile` is the stock
-Jenkins image with that toolchain added. Your jobs, plugins and settings live
-in the `jenkins_home` volume, not in the image, so switching images leaves
-them alone.
+The builds run on a **build agent**, not on Jenkins itself:
+- **The agent:** a container built from `ci/jenkins/Dockerfile`, which is the
+  Jenkins inbound agent plus Python with LIEF, the .NET SDK, the Android NDK
+  and build-tools, apktool, restic and rclone. It runs on Coolify next to
+  Jenkins and connects to it over WebSocket on Docker's internal network. The
+  job runs on it through the `dorknet-builder` label.
+- **Jenkins itself:** stays on the stock image and runs no builds.
 
 | Platform | Output (Jenkins artifacts) | How |
 |---|---|---|
@@ -37,8 +38,8 @@ The job defaults to the builds this branch targets: Steam manifest
 build can be chosen per run. Tick **LIST_SNAPSHOTS** to print the snapshots
 matching a filter without building anything.
 
-A restored snapshot is cached in `jenkins_home/dorknet-cache`, so each stock
-build is downloaded once.
+A restored snapshot is cached on the agent's `dorknet_cache` volume, so each
+stock build is downloaded once.
 
 A Quest build needs a resolved hook table for its versionCode, committed under
 `DorkNet.Quest/targets/`. Only `20230317-2128210.json` exists today. The build
@@ -57,32 +58,61 @@ Resolve a table for another build locally with `build.py build --dump-cs`.
 
 ## Setup
 
-### 1. Switch your Jenkins to this image
+### 1. Jenkins itself
 
-On your Jenkins service in Dokploy:
+Jenkins runs as a Coolify service from a Compose file:
 
-1. **Build from this repo.**
-   - For an Application service: provider GitHub, branch `march-2023-03-21`,
-     build type Dockerfile, Dockerfile path `ci/jenkins/Dockerfile`, build
-     context `ci/jenkins`.
-   - For a Compose service: change its `jenkins` service to `build:` from
-     `ci/jenkins` as in `ci/jenkins/docker-compose.yml`.
-   - Either way, **keep the same volume on `/var/jenkins_home`**.
-2. **Match the Jenkins version.** Set the build argument `JENKINS_IMAGE` to the
-   image the service runs today (e.g. `jenkins/jenkins:2.492.3-lts-jdk17`).
-   The default is `jenkins/jenkins:lts-jdk17`.
-3. **Add the environment:**
+- **Use the Java 25 image**, e.g. `jenkins/jenkins:latest-jdk25`, or
+  `2.587-jdk25` to pin. Jenkins supports Java 25 until September 2029, Java 21
+  only until September 2027, and Java 17 not at all. Keep the agent on the same
+  Java major version; its image defaults to Java 25.
+- **Add `restart: unless-stopped`** to the `jenkins` service. A restart from
+  the Jenkins UI exits the container with code 5 and relies on Docker to
+  start it again. Without a restart policy it stays stopped.
+- **Turn on "Connect to predefined network"** (Advanced) so the agent can
+  reach Jenkins by its container name, `jenkins-<service uuid>`.
+- **Run no builds on it:** **Manage Jenkins → Nodes → Built-In Node →
+  Configure**, set **Number of executors** to `0`.
+
+### 2. The agent node
+
+**Manage Jenkins → Nodes → New Node**, a permanent agent:
+
+| Setting | Value |
+|---|---|
+| Name | `dorknet-builder` |
+| Labels | `dorknet-builder` |
+| Remote root directory | `/home/jenkins/agent` |
+| Launch method | Launch agent by connecting it to the controller, with **Use WebSocket** ticked |
+| Number of executors | 1 |
+
+Save, open the node, and copy its **secret**.
+
+### 3. Deploy the agent on Coolify
+
+1. **Create a Docker Compose application** from this repository: build pack
+   Docker Compose, base directory `/`, compose location
+   `/ci/jenkins/docker-compose.yml`. It needs no domain. Under Advanced, turn
+   on **Connect to predefined network**.
+2. **Set its environment:**
 
    | Variable | Value |
    |---|---|
+   | `JENKINS_URL` | Jenkins' **internal** address, `http://jenkins-<service uuid>:8080/`. Not the public URL, which is behind Cloudflare Access. |
+   | `JENKINS_SECRET` | the node secret from step 2 |
+   | `JENKINS_AGENT_NAME` | optional, default `dorknet-builder` |
    | `ARCHIVE_PC_REPO` | Steam repository folder on the FTP, e.g. `Rec Room Versions/steam-v2` (plain text, not URL-encoded) |
    | `ARCHIVE_QUEST_REPO` | Quest repository folder, e.g. `Rec Room Versions/quest-v2` |
    | `ARCHIVE_FTP_TLS` | `explicit` (default), `implicit` or `none` |
 
-4. **Redeploy.** The first image build downloads the Android NDK (~1.5 GB) and
-   takes a while.
+3. **Deploy.** The first image build downloads the Android NDK (~1.5 GB) and
+   takes a while. The node shows as connected in Jenkins once the agent is up.
 
-### 2. Plugins
+Both Jenkins and the agent join the server's predefined Coolify network, so
+the agent reaches Jenkins by container name. Check the name under the Jenkins
+service's containers before using it.
+
+### 4. Plugins
 
 The job needs these plugins:
 
@@ -96,7 +126,7 @@ The job needs these plugins:
 
 Most are part of the suggested set.
 
-### 3. Credentials
+### 5. Credentials
 
 Add these under **Manage Jenkins → Credentials**, with exactly these IDs:
 
@@ -115,7 +145,7 @@ Add these under **Manage Jenkins → Credentials**, with exactly these IDs:
 different key means every player has to uninstall before installing a CI
 build.
 
-### 4. The job
+### 6. The job
 
 1. Create a **New Item → Pipeline** (e.g. `dorknet-client`).
 2. Under **Pipeline**, choose **Pipeline script from SCM**:
@@ -126,7 +156,7 @@ build.
 4. Run it once with **Build** so Jenkins learns the parameters. Later runs
    offer **Build with Parameters**.
 
-### 5. GitHub webhook
+### 7. GitHub webhook
 
 In the repository's **Settings → Webhooks**:
 
@@ -136,5 +166,5 @@ In the repository's **Settings → Webhooks**:
 
 ### Disk
 
-The restored stock builds are cached in `jenkins_home/dorknet-cache`, several
-GB each. Jenkins keeps the artifacts of the last 3 runs.
+The agent's `dorknet_cache` volume holds the restored stock builds, several GB
+each. Jenkins keeps the artifacts of the last 3 runs, on its own volume.