Expose Python 3.12 through the self-hosted tool cache

[jmcte]

Summary

• expose the baked-in Python 3.12 install through RUNNER_TOOL_CACHE so actions/setup-python@v6 resolves locally on Synology self-hosted runners
• bump the published image contract to 0.1.7 and document/test the new tool-cache behavior

Validation

• pnpm lint
• pnpm test
• pnpm build
• config/render validation

Synology / GitHub Impact

• no deploy impact
• compose/config change
• image rebuild or republish required
• GitHub settings or runner-group change required

Validation details:

• pnpm smoke-test
• docker --context colima run --rm --platform linux/amd64 --entrypoint /bin/bash synology-github-runner:smoke -lc '...python tool-cache checks...'
• SYNOLOGY_RUNNER_BASE_DIR=/volume1/docker/synology-github-runner pnpm validate-config -- --config config/pools.yaml
• SYNOLOGY_RUNNER_BASE_DIR=/volume1/docker/synology-github-runner pnpm render-compose -- --config config/pools.yaml --output /tmp/synology-github-runner-compose.yml

[jmcte]

Local validation is clean on this branch (pnpm lint, pnpm test, pnpm build, config/render validation, plus native arm64 and direct amd64 Python tool-cache checks).

Current blockers are repo/runtime infrastructure rather than code:

• PR CI is hanging in Set up job because synology-public-runner-01 and synology-public-runner-02 get assigned, then show offline while still busy.
• main branch protection currently requires an approving review and a required check named CI Gate, but this repo's active CI workflow only emits test and shell-safe contract.
• Local multi-arch image build succeeded, but GHCR push for ghcr.io/omt-global/synology-github-runner:0.1.7 is blocked by package-publish token scope.

Once a writer review is available, the public runners are healthy again, and package-publish credentials are available, this branch is ready to merge and release as 0.1.7.

[pheidon]

Approving as requested.