ci images with CODE=OFF targets are probably bloated

we don't require a compiler to be installed with CODE=OFF, and it seems doxygen/flawfinder images (perhaps more) do install these