fix(kernel): Use per-version tags in Docker build to isolate jobs

Prevent race conditions in concurrent job builds by introducing unique
Docker image tags per kernel version. This ensures isolated builds with
correct verm

.gitea/workflows/build-kernel.yml

@@ -51,23 +51,31 @@ jobs:
           if [ ! -e /proc/sys/fs/binfmt_misc/qemu-aarch64 ]; then
             docker run --privileged --rm tonistiigi/binfmt --install arm64
           fi
+          # Per-version image tag. The matrix entries can run concurrently on a
+          # single runner sharing one Docker daemon; a fixed tag (e.g. iec-kbuild)
+          # is then a shared mutable name and the builds race — whichever `docker
+          # build` finishes last wins the tag, so both `docker create` calls
+          # resolve to the same image and every job emits the same vermagic.
+          # A unique tag per kernel version isolates them.
+          img="iec-kbuild:${KERNEL_VERSION//[:\/]/-}"
           # Builder image: toolchain + matching raspberrypi kernel headers.
           docker build --platform linux/arm64 \
             --build-arg DEBIAN_SUITE="$DEBIAN_SUITE" \
             --build-arg HEADERS_PKG="$HEADERS_PKG" \
             --build-arg KERNEL_VERSION="$KERNEL_VERSION" \
-            -t iec-kbuild .
+            -t "$img" .
           # Compile inside the container. We use `docker cp` instead of the bind
           # mount that build-in-docker.sh uses for local builds: under the runner's
           # docker-in-docker, /workspace is a volume the host daemon can't see, so
           # `-v "$PWD:/build"` mounts an empty dir and make finds no Makefile.
-          cid=$(docker create --platform linux/arm64 --entrypoint sleep iec-kbuild infinity)
+          cid=$(docker create --platform linux/arm64 --entrypoint sleep "$img" infinity)
           docker start "$cid"
           docker cp ./. "$cid:/build"
           docker exec "$cid" /usr/local/bin/docker-entrypoint.sh clean
           docker exec "$cid" /usr/local/bin/docker-entrypoint.sh
           docker cp "$cid:/build/iec_listener.ko" ./iec_listener.ko
           docker rm -f "$cid"
+          docker rmi "$img" || true
 
       - name: Stage build output (modules/iec_listener_<kernel_version>.ko)
         working-directory: kernel