ci(update-all): use prebuilt ci-ansible image

Pilots the swap from alpine:3.21 + apk/pip/galaxy preamble to the
prebuilt ci-ansible image. Pinned to :2026-04-29 so a future image
rebuild doesn't change behavior here without an explicit tag bump.

Also replaces the python3 -c base64 decode with shell base64 -d,
matching the pattern in deploy-infrastructure.yml.

.woodpecker/update-all.yml

@@ -8,7 +8,7 @@ timeout: 120
 
 steps:
   - name: update-all
-    image: alpine:3.21
+    image: gitea.renner.uno/gitea_admin/ci-ansible:2026-04-29
     environment:
       ANSIBLE_FORCE_COLOR: "true"
       ANSIBLE_HOST_KEY_CHECKING: "false"
@@ -22,11 +22,8 @@ steps:
       PROXMOX_TOKEN_SECRET:
         from_secret: proxmox_token_secret
     commands:
-      - apk add --no-cache openssh-client git ansible python3 py3-pip
-      - pip3 install --break-system-packages proxmoxer requests
-      - ansible-galaxy collection install community.proxmox community.docker
       - mkdir -p ~/.ssh
-      - python3 -c "import base64,os; open(os.path.expanduser('~/.ssh/id_ed25519'),'wb').write(base64.b64decode(os.environ['SSH_PRIVATE_KEY']))"
+      - echo "$SSH_PRIVATE_KEY" | base64 -d > ~/.ssh/id_ed25519
       - chmod 600 ~/.ssh/id_ed25519
       - printf "Host *\n\tStrictHostKeyChecking no\n\tUserKnownHostsFile /dev/null\n" > ~/.ssh/config
       - cd ansible