fix: bake CI deps into Docker image, fix chunk use_metadata OOB

- Build and push fastsync-ci:v8 with lcov, valgrind, clang baked in
- Remove all apt-get install steps from CI (v8 has them pre-installed)
- Fix chunk.c use_metadata=true OOB: add remaining_size guard before
  metadata_from_buf reads past the buffer. The bug allowed network-facing
  chunk_deserialize to heap-buffer-overflow on crafted inputs.
- Also guard against unsigned underflow on remaining_size - sizeof(int)

.gitea/workflows/ci.yaml

@@ -5,7 +5,7 @@ on: [push, pull_request]
 jobs:
   lint:
     runs-on: ubuntu-latest
-    container: gitea.tap-tap.win/taptap/fastsync-ci:v7
+    container: gitea.tap-tap.win/taptap/fastsync-ci:v8
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -18,7 +18,7 @@ jobs:
 
   build-and-test:
     runs-on: ubuntu-latest
-    container: gitea.tap-tap.win/taptap/fastsync-ci:v7
+    container: gitea.tap-tap.win/taptap/fastsync-ci:v8
     needs: lint
     steps:
       - name: Checkout
@@ -38,7 +38,7 @@ jobs:
 
   sanitizers:
     runs-on: ubuntu-latest
-    container: gitea.tap-tap.win/taptap/fastsync-ci:v7
+    container: gitea.tap-tap.win/taptap/fastsync-ci:v8
     needs: lint
     strategy:
       matrix:
@@ -58,15 +58,12 @@ jobs:
 
   fuzz-build:
     runs-on: ubuntu-latest
-    container: gitea.tap-tap.win/taptap/fastsync-ci:v7
+    container: gitea.tap-tap.win/taptap/fastsync-ci:v8
     needs: lint
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Install clang
-        run: apt-get update -qq && apt-get install -y -qq clang
-
       - name: Configure (clang + fuzz)
         run: CC=clang CXX=clang++ cmake -B build-fuzz -S . -DENABLE_FUZZ=ON
 
@@ -75,15 +72,12 @@ jobs:
 
   coverage:
     runs-on: ubuntu-latest
-    container: gitea.tap-tap.win/taptap/fastsync-ci:v7
+    container: gitea.tap-tap.win/taptap/fastsync-ci:v8
     needs: lint
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Install lcov
-        run: apt-get update -qq && apt-get install -y -qq lcov
-
       - name: Configure
         run: cmake -B build -S . -DENABLE_COVERAGE=ON -DSTRICT_WARNINGS=ON
 
@@ -101,15 +95,12 @@ jobs:
 
   valgrind:
     runs-on: ubuntu-latest
-    container: gitea.tap-tap.win/taptap/fastsync-ci:v7
+    container: gitea.tap-tap.win/taptap/fastsync-ci:v8
     needs: lint
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Install valgrind
-        run: apt-get update -qq && apt-get install -y -qq valgrind
-
       - name: Configure
         run: cmake -B build -S . -DSTRICT_WARNINGS=ON