feat(runner): define the portable runner image

[Windsor Nguyễn (windsornguyen)]

Summary

This change defines a runner image from GitHub's digest-pinned actions-runner image. It adds a portable x64 and arm64 userspace contract and typed actions that build, inspect, and verify the image.

Evidence

• The pinned upstream OCI index contains native linux/amd64 and linux/arm64 manifests.
• Docker builds and verifies the image on native arm64.
• Docker and Podman verify the image on GitHub-hosted native x64 and arm64 runners.
• ImageOS remains inventory because the GitHub arm64 host reports ubuntu24-arm64 and the official arm64 container reports ubuntu24.

Tests

• npm run lint.
• npm run typecheck.
• npm test.
• npm run build.
• npm run check.
• npm run package.
• npm audit --audit-level=high.
• npm audit signatures.
• Native x64 and arm64 Docker and Podman image verification.

Compatibility

This change adds the image contract and local actions. The image supports the two native Linux architectures in GitHub's official OCI image.

The image contains the GitHub runner binaries, but Hollywood does not invoke the runner worker or reproduce the GitHub-hosted virtual machine.

Review focus

Review the upstream digest, source labels, portable contract fields, provider-owned fields, and image cleanup.

[cind-bot]

Here's a flower for all your hard work! 🌸