chore(infra): pin act_runner image pull policy (#10)

## Summary
`act_runner`'s default `container.force_pull: true` re-issues a `docker pull` at the start of every job, adding 10–30 s of registry round-trip even when every layer is already locally cached. With job images pinned to specific tags (`catthehacker/ubuntu:act-22.04` and `:full-22.04`), the implicit pull is pure overhead and contradicts the deliberate-upgrade policy ADR-0015 spells out for the runner image.

- Add `infra/runner-config.yaml` with `container.force_pull: false`.
- Mount it read-only into all three runners and point each at it via `CONFIG_FILE=/etc/runner/config.yaml`.
- Document the pre-pull procedure and image-upgrade playbook in `infra/README.md` → "Job image pinning and pre-pull".
- Fold the pre-pull into the "First-time registration" walkthrough so a fresh setup is correct end-to-end.

The trade-off: the runner host must hold the images locally before the runner is asked to use them. Documented.

## Roll-out (manual, on the runner host)
```bash
cd infra/

# 1. Pre-pull the job images (one-shot — pays the cold cost once).
docker pull catthehacker/ubuntu:act-22.04
docker pull catthehacker/ubuntu:full-22.04

# 2. Recreate the runners so the new mount + env var take effect.
docker compose -f ci-runners.compose.yml up -d --force-recreate

---------

Co-authored-by: Julien Gautier <julien.gautier@apf.asso.fr>
Reviewed-on: #10

infra/runner-config.yaml

@@ -0,0 +1,16 @@
+# act_runner config — shared by all three runner instances defined
+# in ci-runners.compose.yml. Mounted read-only at /etc/runner/config.yaml
+# inside each container, selected via the CONFIG_FILE environment variable.
+#
+# Generated from `act_runner generate-config` and trimmed to the keys we
+# actually need to override. Defaults for everything else.
+# See: https://gitea.com/gitea/act_runner/src/branch/main/internal/pkg/config/config.example.yaml
+
+container:
+  # Skip the per-job `docker pull` round-trip when the image is already
+  # cached locally. The default (true) re-checks the registry on every
+  # job start, adding 10-30s of latency per job for no value once the
+  # tag is pinned. Image upgrades happen deliberately on the runner
+  # host (see infra/README.md "Updating the runner job images") — not
+  # implicitly via :latest.
+  force_pull: false