feat(tfroot-runner): rebase onto ghcr.io/actions/actions-runner

[xnoto]

Summary

Rebase the tfroot-runner image onto `ghcr.io/actions/actions-runner:latest` (Ubuntu 22.04, glibc-native) following the multi-stage layout in `hatch1fy/infra-images/terraform-runner`. The runner agent is already inside the base, so jobs labeled `runs-on: tfroot-runner` will execute directly in the pod with no nested `container:` block and no glibc-shim wrangling.

Stage 1 — `ubuntu:24.04` builder

• Python 3.14 venv with `pre-commit` + `checkov`
• Binary downloads: tofu (with `terraform` symlink), kubectl, kustomize, sops, terraform-docs, tfupdate, hcledit, tflint, infracost
• All stripped at the end

Stage 2 — `ghcr.io/actions/actions-runner:latest`

• apt: python3.14 (runtime only), ansible-core, openssh-client, jq, genisoimage, gnupg, make, shellcheck, libatomic1
• yq via direct binary download (the `yq` apt package is the wrong tool)
• COPY of all builder binaries + the venv
• Pre-cache pre-commit hooks as `runner` user
• USER `runner` — required by ARC

Test plan

• After image build: `docker run --rm --entrypoint sh ghcr.io/makeitworkcloud/tfroot-runner:latest -c 'id; tofu version; kubectl version --client; sops --version; pre-commit --version'` — uid=1000(runner), all tools present
• After image build: `docker run --rm --entrypoint /home/runner/run.sh ghcr.io/makeitworkcloud/tfroot-runner:latest --version` — actions/runner banner
• After kustomize-cluster runner-set lands: GitHub UI shows `tfroot-runner` runner set; ephemeral runner pods spawn for jobs labeled `runs-on: tfroot-runner`

Pairs with

• kustomize-cluster (incoming): `workloads/arc/tfroot-runner-application.yaml` deploying the runner-set against this image.
• shared-workflows (incoming): make `container:` optional, default `runs-on: tfroot-runner`.
• tfroot-libvirt (incoming): caller switches to `runs-on: tfroot-runner`.

🤖 Generated with Claude Code