chore(infra): pin act_runner image pull policy

`act_runner`'s default `container.force_pull: true` re-issues a
`docker pull` at the start of every job, adding 10-30 s of registry
round-trip per job even when every layer is already locally cached.
The job images are already pinned to specific tags (catthehacker
ubuntu :act-22.04 + :full-22.04), so the implicit pull is both pure
overhead and contradictory with the deliberate-upgrade policy
ADR-0015 spells out for the runner image itself.

Mount a shared `infra/runner-config.yaml` into all three runners
with `force_pull: false`, point each runner at it via the
`CONFIG_FILE` env var, and document the pre-pull procedure (one-shot
`docker pull` on the runner host, plus the upgrade playbook) in
infra/README.md "Job image pinning and pre-pull".

The pre-pull is also folded into the "First-time registration"
walkthrough so a fresh setup is correct end-to-end.

infra/ci-runners.compose.yml

@@ -25,11 +25,16 @@ services:
       # act-compatible runners — bundles Node, Python, git, common build
       # tools, and the Docker CLI.
       GITEA_RUNNER_LABELS: self-hosted:docker://catthehacker/ubuntu:act-22.04,on-prem:docker://catthehacker/ubuntu:act-22.04
+      # Path of the shared act_runner config file inside the container,
+      # mounted read-only via volumes below (see infra/runner-config.yaml).
+      CONFIG_FILE: /etc/runner/config.yaml
     volumes:
       # Docker socket — see security note in infra/README.md.
       - /var/run/docker.sock:/var/run/docker.sock
       # Persistent state: runner credentials live here after first registration.
       - ./data/runner-1:/data
+      # Shared act_runner configuration — see infra/runner-config.yaml.
+      - ./runner-config.yaml:/etc/runner/config.yaml:ro
     networks:
       - act-runners
 
@@ -48,9 +53,13 @@ services:
       # act-compatible runners — bundles Node, Python, git, common build
       # tools, and the Docker CLI.
       GITEA_RUNNER_LABELS: self-hosted:docker://catthehacker/ubuntu:act-22.04,on-prem:docker://catthehacker/ubuntu:act-22.04
+      # Path of the shared act_runner config file inside the container,
+      # mounted read-only via volumes below (see infra/runner-config.yaml).
+      CONFIG_FILE: /etc/runner/config.yaml
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - ./data/runner-2:/data
+      - ./runner-config.yaml:/etc/runner/config.yaml:ro
     networks:
       - act-runners
 
@@ -69,9 +78,13 @@ services:
       # act-compatible runners — bundles Node, Python, git, common build
       # tools, and the Docker CLI.
       GITEA_RUNNER_LABELS: self-hosted:docker://catthehacker/ubuntu:act-22.04,on-prem:docker://catthehacker/ubuntu:act-22.04
+      # Path of the shared act_runner config file inside the container,
+      # mounted read-only via volumes below (see infra/runner-config.yaml).
+      CONFIG_FILE: /etc/runner/config.yaml
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - ./data/runner-3:/data
+      - ./runner-config.yaml:/etc/runner/config.yaml:ro
     networks:
       - act-runners