feat(ci): baked CI image + runner config + self-check workflow (T14)

Stand up the foundation's own CI on its Forgejo runner. The committed scope here
is the self-contained half (toolchain + typecheck); the stack-state-dependent
pipelines (pulumi preview, backup-verify) need CI secrets + a state fetch and
land next.

- containers/ci-image/Dockerfile + VERSIONS IMAGE_CI: one baked image carrying
  exactly what preflight validates (pulumi/bun/node/docker/git/age/zstd/jq/vault/
  psql/mc). Built on the VM (like caddy-cloudflare) and used LOCALLY by the runner.
- runner.ts: give act_runner a config.yaml — container.network=foundation-net (so
  job containers reach foundation-forgejo:3000 for checkout + the data plane) and
  force_pull=false (use the local foundation-ci image, no registry). Self-heals on up.
- .forgejo/workflows/ci.yml: preflight (tools + versions vs VERSIONS pins) +
  typecheck (bun install + tsc --noEmit on bootstrap). Gates every push.
- run.sh / backup.sh / restore.sh / dr: take PULUMI_CONFIG_PASSPHRASE from env when
  set (CI secret), falling back to `pass` (operator) — so the scripts run pass-free
  in CI.

Reusable-workflows architecture (per the chosen direction) — the ecosystem CI
(semantic-release, docker/npm/bun builds, eslint/yamllint over the 999_testing.md
candidates) builds on this image + runner next phase.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

bootstrap/components/runner.ts

@@ -42,6 +42,24 @@ export function deployRunner(
     { provider, retainOnDelete: true }, // holds .runner registration secret
   );
 
+  // act_runner config (T14): job containers must join foundation-net to reach
+  // foundation-forgejo:3000 (checkout) + the data plane, and must NOT force-pull —
+  // the CI toolchain image (foundation-ci, VERSIONS IMAGE_CI) is built locally on the
+  // VM, not in a registry. valid_volumes allows jobs to mount the host docker socket
+  // (docker-label builds). Re-written on every up so config drift self-heals.
+  const RUNNER_CONFIG = `log:
+  level: info
+runner:
+  capacity: 2
+  timeout: 30m
+  fetch_interval: 2s
+container:
+  network: foundation-net
+  force_pull: false
+  valid_volumes:
+    - /var/run/docker.sock
+`;
+
   const register = new command.remote.Command(
     "foundation-runner-register",
     {
@@ -51,6 +69,7 @@ VOL=foundation-runner-data
 IMG='${img}'
 LABELS='${labels}'
 docker volume inspect "$VOL" >/dev/null 2>&1 || docker volume create "$VOL" >/dev/null
+printf '%s' '${RUNNER_CONFIG}' | docker run --rm -i --entrypoint sh -v "$VOL":/data "$IMG" -c 'cat > /data/config.yaml'
 if docker run --rm --entrypoint sh -v "$VOL":/data "$IMG" -c '[ -s /data/.runner ]'; then
   echo "runner already registered"
 else
@@ -60,7 +79,7 @@ else
   echo "runner registered"
 fi`,
       addPreviousOutputInEnv: false,
-      triggers: [forgejo.ready.id, labels],
+      triggers: [forgejo.ready.id, labels, RUNNER_CONFIG],
     },
     { dependsOn: [forgejo.ready] },
   );
@@ -73,7 +92,7 @@ fi`,
       hostname: "foundation-runner",
       restart: "unless-stopped",
       entrypoints: ["/bin/forgejo-runner"],
-      command: ["daemon"],
+      command: ["daemon", "-c", "/data/config.yaml"], // T14 runner config (network/force_pull)
       // The image runs as uid 1000; add the host docker group (gid of
       // /var/run/docker.sock) so the daemon can reach the socket without running
       // as root. NOTE: 996 is THIS host's docker gid — re-check on DR to a new VM