fix(ci): pin act_runner job image to catthehacker/ubuntu:act-22.04 (#4)

## Summary

- Pin `act_runner`'s job container image to `catthehacker/ubuntu:act-22.04` via the `<label>:docker://<image>` format on the runner registration labels.
- Update `infra/ci-runners.compose.yml`'s `GITEA_RUNNER_LABELS` for all three runner services, with an inline comment explaining the format requirement.
- Amend ADR-0015 §"Runners" to specify the chosen image and explain the docker-suffix syntax trap.

## Motivation

The first real PR test of the CI pipeline failed at the very first step:

```
Run actions/checkout@v4
0s
Cannot find: node in PATH
❌ Failure - Main actions/checkout@v4
```

Root cause: `act_runner` registers labels (`self-hosted`, `on-prem`) without a `docker://` image suffix. Without that suffix, act spawns jobs in a minimal default container that has no Node. Every JavaScript action (`actions/checkout`, `actions/setup-node`, `nrwl/nx-set-shas`, the Trivy/gitleaks actions) crashes during the action's launch step. None of the five CI gates can run.

`catthehacker/ubuntu:act-22.04` is the de facto image used by `act` upstream and the standard recommendation for self-hosted Gitea Actions runners. It bundles Node, Python, git, common build tools, and the Docker CLI — exactly the assumed environment for GitHub Actions-compatible workflows.

## Implementation notes

- The fix lives in `GITEA_RUNNER_LABELS` because that's what `act_runner` reads at registration time. The label-to-image mapping is then persisted in the runner's `data/runner-N/.runner` credential.
- For runners **already registered** (i.e. the three currently-running `apf-portal-runner-N`), the persisted credential ignores the new env var. Their labels must be updated through Gitea's UI (Site Administration → Actions → Runners → each runner → edit `Labels`). This is documented in the commit message and is an operational follow-up to merging this PR.
- The compose-file change applies the next time a runner is re-registered (e.g. when `data/runner-N/` is wiped or a new fourth runner is added).
- ADR-0015 amendment is in-place, status remains `accepted`. The runner-image choice is an implementation detail under the existing decision; no new ADR.

## Verification

- [ ] `pnpm ci:check` — n/a, this PR only changes infra and ADR docs, no code paths.
- [ ] **Manual:** after merge + Gitea label updates, the next PR's `actions/checkout@v4` step runs without `Cannot find: node in PATH`.

## Related

- [ADR-0015 — CI/CD pipeline](docs/decisions/0015-cicd-gitea-actions.md). Amended in §"Runners".
- [`infra/README.md`](infra/README.md) — operational doc for the runners; mentions the registration workflow but predates this format requirement. A subsequent docs touch could mirror the new label format there too; deferred to keep this PR scoped to the actual fix.

---------

Co-authored-by: Julien Gautier <julien.gautier@apf.asso.fr>
Reviewed-on: #4

infra/ci-runners.compose.yml

@@ -18,7 +18,13 @@ services:
       GITEA_INSTANCE_URL: ${GITEA_INSTANCE_URL:?GITEA_INSTANCE_URL must be set in infra/.env}
       GITEA_RUNNER_REGISTRATION_TOKEN: ${GITEA_RUNNER_REGISTRATION_TOKEN:-}
       GITEA_RUNNER_NAME: apf-portal-runner-1
-      GITEA_RUNNER_LABELS: self-hosted,on-prem
+      # Labels are formatted as <label>:docker://<image>. Without the
+      # docker:// suffix, act_runner uses a minimal default image with no
+      # Node, breaking any JavaScript action (actions/checkout etc.).
+      # catthehacker/ubuntu:act-22.04 is the de facto standard for
+      # act-compatible runners — bundles Node, Python, git, common build
+      # tools, and the Docker CLI.
+      GITEA_RUNNER_LABELS: self-hosted:docker://catthehacker/ubuntu:act-22.04,on-prem:docker://catthehacker/ubuntu:act-22.04
     volumes:
       # Docker socket — see security note in infra/README.md.
       - /var/run/docker.sock:/var/run/docker.sock
@@ -35,7 +41,13 @@ services:
       GITEA_INSTANCE_URL: ${GITEA_INSTANCE_URL:?GITEA_INSTANCE_URL must be set in infra/.env}
       GITEA_RUNNER_REGISTRATION_TOKEN: ${GITEA_RUNNER_REGISTRATION_TOKEN:-}
       GITEA_RUNNER_NAME: apf-portal-runner-2
-      GITEA_RUNNER_LABELS: self-hosted,on-prem
+      # Labels are formatted as <label>:docker://<image>. Without the
+      # docker:// suffix, act_runner uses a minimal default image with no
+      # Node, breaking any JavaScript action (actions/checkout etc.).
+      # catthehacker/ubuntu:act-22.04 is the de facto standard for
+      # act-compatible runners — bundles Node, Python, git, common build
+      # tools, and the Docker CLI.
+      GITEA_RUNNER_LABELS: self-hosted:docker://catthehacker/ubuntu:act-22.04,on-prem:docker://catthehacker/ubuntu:act-22.04
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - ./data/runner-2:/data
@@ -50,7 +62,13 @@ services:
       GITEA_INSTANCE_URL: ${GITEA_INSTANCE_URL:?GITEA_INSTANCE_URL must be set in infra/.env}
       GITEA_RUNNER_REGISTRATION_TOKEN: ${GITEA_RUNNER_REGISTRATION_TOKEN:-}
       GITEA_RUNNER_NAME: apf-portal-runner-3
-      GITEA_RUNNER_LABELS: self-hosted,on-prem
+      # Labels are formatted as <label>:docker://<image>. Without the
+      # docker:// suffix, act_runner uses a minimal default image with no
+      # Node, breaking any JavaScript action (actions/checkout etc.).
+      # catthehacker/ubuntu:act-22.04 is the de facto standard for
+      # act-compatible runners — bundles Node, Python, git, common build
+      # tools, and the Docker CLI.
+      GITEA_RUNNER_LABELS: self-hosted:docker://catthehacker/ubuntu:act-22.04,on-prem:docker://catthehacker/ubuntu:act-22.04
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - ./data/runner-3:/data