Add gha-runner image (build tools for self-hosted CI)

images/gha-runner/Dockerfile

@@ -0,0 +1,37 @@
+# syntax=docker/dockerfile:1
+# Custom GitHub Actions runner image for my home cluster's ARC scale set.
+#
+# The upstream actions/actions-runner image is intentionally minimal and lacks
+# tools that ubuntu-latest ships and our workflows assume:
+#   make + build-essential -> Makefile targets and Python C-extension builds
+#   libatomic1             -> pnpm's prebuilt binary needs libatomic.so.1
+#   docker compose plugin  -> the `docker compose` subcommand (compose smoke tests)
+#
+# arm64-only: the cluster nodes (and therefore the runners) are aarch64.
+ARG RUNNER_VERSION=2.335.1
+FROM ghcr.io/actions/actions-runner:${RUNNER_VERSION}
+
+ARG COMPOSE_VERSION=v2.32.4
+
+USER root
+
+# hadolint ignore=DL3008
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+      build-essential \
+      ca-certificates \
+      curl \
+      git \
+      jq \
+      libatomic1 \
+      make \
+ && rm -rf /var/lib/apt/lists/*
+
+# Docker Compose v2 as a CLI plugin (not packaged in the runner image). aarch64
+# binary into a standard cli-plugins search path so `docker compose` resolves.
+RUN mkdir -p /usr/local/lib/docker/cli-plugins \
+ && curl -fsSL "https://github.com/docker/compose/releases/download/${COMPOSE_VERSION}/docker-compose-linux-aarch64" \
+      -o /usr/local/lib/docker/cli-plugins/docker-compose \
+ && chmod +x /usr/local/lib/docker/cli-plugins/docker-compose
+
+USER runner

images/gha-runner/README.md

@@ -0,0 +1,15 @@
+# gha-runner
+
+Custom GitHub Actions runner image for my **home cluster's ARC scale set** — the
+upstream `actions/actions-runner` plus the tools `ubuntu-latest` ships that the
+minimal image doesn't, so self-hosted lint/test jobs work:
+
+- `make` + `build-essential` — Makefile targets and Python C-extension builds
+- `libatomic1` — pnpm's prebuilt binary needs `libatomic.so.1`
+- the `docker compose` CLI plugin — compose-based smoke tests
+
+`arm64`-only (the runners are aarch64). Built and published by the standard
+matrix (`publish.yml`) like every other image, to
+`ghcr.io/mgarratt/docker-images/gha-runner`. This repo is public, so the package
+is public too and the ARC scale set pulls it without a secret; the
+`arc-runner-set` HelmRelease in the home cluster points its runner `image:` here.

images/gha-runner/image.toml

@@ -0,0 +1,6 @@
+image = "gha-runner"
+# arm64-only: the ARC scale-set runners are aarch64, so there is no amd64 runner
+# to schedule an amd64 variant on. The matrix passes these per-image platforms to
+# buildx.
+platforms = ["linux/arm64"]
+build_args = { RUNNER_VERSION = "2.335.1", COMPOSE_VERSION = "v2.32.4" }