Build release images without the layer cache

A submission failed with HTTP 403 against a freshly published image. The
cause was not Alpine, which carries the current yt-dlp: it was the apk layer
being reused from an older build, so the image shipped a yt-dlp two months
behind while /healthz reported today's tag.

"A rebuild is the update" only holds if the layer is genuinely re-run, so
the image target now passes --pull --no-cache. Slower, and the only thing
that makes the release honest about what is inside it.

Makefile

@@ -42,10 +42,14 @@ run: build
 # out of this file: pass it in, or put it in the .env this reads nothing from.
 #
 #   make image IMAGE=registry.example.com/owner/levyraati26-go
+#
+# --pull --no-cache is the point of the target, not caution. yt-dlp rots against YouTube within
+# weeks, and "a rebuild is the update" is only true if the apk layer is actually re-run — a cached
+# one silently ships whatever yt-dlp was current the day that layer was first built.
 image:
 	@test -n "$(IMAGE)" || { echo "set IMAGE, e.g. make image IMAGE=registry.example.com/owner/levyraati26-go"; exit 1; }
 	@v=$$(git describe --tags --exact-match 2>/dev/null) || { echo "HEAD is not tagged; tag the release first"; exit 1; }; \
-	podman build --build-arg VERSION=$$v -t $(IMAGE):$$v -t $(IMAGE):latest . && \
+	podman build --pull --no-cache --build-arg VERSION=$$v -t $(IMAGE):$$v -t $(IMAGE):latest . && \
 	echo "built $(IMAGE):$$v — push with: podman push $(IMAGE):$$v"
 
 # Operations against the running container, straight out of docs/deployment.md.