Split web image's large RUN blocks into per-layer steps; add per-template VERSION files to skip unchanged reprovisioning

The registry sits behind a reverse proxy that 413s large blob pushes,
so templates/web/Dockerfile's oversized RUN blocks (apt installs,
rustup targets, cargo installs) are broken up so no single layer is
too big to push.

Also adds templates/<name>/VERSION (starting at "1" for all six
templates) and has the provision job's push step look up whether that
version is already pushed before running coder templates push, since
the workflow triggers on any change under templates/** and previously
reprovisioned every template on every push, not just the one that
changed.

.gitea/workflows/coder-templates.yml

@@ -2,8 +2,13 @@ name: Provision Coder Templates
 
 # Keeps Coder templates in sync with templates/*/ in this repo:
 #   - every push to main pushes a new version of each templates/<env>/ dir
-#     (coder templates push creates it if it doesn't exist yet, so adding a
-#     new templates/<env>/ directory is enough to provision a new one)
+#     whose VERSION file names a version not already pushed (coder templates
+#     push creates the template if it doesn't exist yet, so adding a new
+#     templates/<env>/ directory - with a VERSION file - is enough to
+#     provision a new one). This workflow triggers on any change under
+#     templates/**, not just a specific template's own directory, so VERSION
+#     is what keeps an edit to one template from generating a no-op new
+#     version for every other, unchanged template.
 #   - if a templates/<env>/ directory is removed on main, its template is
 #     deleted from Coder. `coder templates delete` refuses to delete a
 #     template that still has active workspaces, so this can't silently
@@ -154,9 +159,34 @@ jobs:
                 continue
                 ;;
             esac
+
+            # templates/<name>/VERSION lets a template opt out of being
+            # reprovisioned on every push: bump it and coder templates push
+            # names the new version "v<N>"; leave it as-is and this looks up
+            # whether that version name is already pushed and skips if so.
+            # This is a manual contract, not a content hash - editing a
+            # template without bumping its VERSION means the change won't
+            # go out until someone does. paths: on this workflow's trigger
+            # is templates/** as a whole, so without this every template
+            # gets a new (identical) version on any push under templates/,
+            # even ones whose own directory didn't change.
+            version=""
+            if [ -f "$dir/VERSION" ]; then
+              version="$(tr -d '[:space:]' < "$dir/VERSION")"
+            fi
+            if [ -n "$version" ]; then
+              existing="$(coder templates versions list "$full" -o json 2>/dev/null || true)"
+              if [ -n "$existing" ] && echo "$existing" | jq -e --arg v "v$version" 'any(.[]; .name == $v)' >/dev/null 2>&1; then
+                echo "Skipping $full - version v$version (templates/$name/VERSION) is already pushed. Bump the VERSION file to push a new one."
+                continue
+              fi
+            fi
+
+            args=(-d "$dir" --yes -m "auto-provisioned from ${GITHUB_SHA:0:12}")
+            [ -n "$version" ] && args+=(--name "v$version")
+
             echo "::group::Pushing $full from $dir"
-            coder templates push "$full" -d "$dir" --yes \
-              -m "auto-provisioned from ${GITHUB_SHA:0:12}"
+            coder templates push "$full" "${args[@]}"
             echo "::endgroup::"
           done