ci(rebuild-k8s): swap recreate-vms to prebuilt ci-tofu image

The recreate-vms step still pulled ghcr.io/opentofu/opentofu:1.11
and ran `apk add --no-cache git openssh-client curl` on every run —
the only step in this pipeline that hadn't been migrated to a
prebuilt ci-* image. Each invocation was an apk roundtrip plus a
GHCR pull, and the resulting tool versions were whatever Alpine
edge happened to ship that day.

Swap to gitea.renner.uno/gitea_admin/ci-tofu:2026-04-29, which
already bakes git, openssh-client, curl, and tofu 1.11.0. The
inline `apk add` line goes away; everything else in the step
keeps working unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.woodpecker/rebuild-k8s.yml

@@ -4,7 +4,7 @@ when:
 
 steps:
   - name: recreate-vms
-    image: ghcr.io/opentofu/opentofu:1.11
+    image: gitea.renner.uno/gitea_admin/ci-tofu:2026-04-29
     directory: opentofu
     environment:
       TF_IN_AUTOMATION: "true"
@@ -32,7 +32,6 @@ steps:
       SSH_PRIVATE_KEY:
         from_secret: ssh_private_key
     commands:
-      - apk add --no-cache git openssh-client curl
       - mkdir -p ~/.ssh
       - echo "$SSH_PRIVATE_KEY" | base64 -d > ~/.ssh/id_ed25519
       - chmod 600 ~/.ssh/id_ed25519