feat(ci): add versioned offline template runtime image

[acedward]

Summary

• publish a public, versioned linux/amd64 template runtime image after successful npm publication
• bake all 14 enabled template dependency trees, pinned toolchains, browsers, compilers, and seven verified chain binaries into the image
• keep template baseline synchronization manual and independent from normal npm releases
• add shared read-only binary caches, writable runtime state, offline compatibility links, public-payload auditing, SBOM/provenance, immutable promotion, and anonymous-pull gates
• require a configurable runner with at least 50 GiB free and release BuildKit cache before candidate pull/testing

Release contract

• the image and npm package follow release version V
• embedded templateBaselineVersion is curated independently
• normal npm releases do not update templates/**
• manual Sync Template Baseline is the only CI path that updates template pins and locks
• stable and SHA tags are promoted by digest after offline checks; latest moves last

Validation

• full linux/amd64 image build: 3,195,012,222 bytes in 38m39s
• network-disabled runtime checks: all 14 templates listed; all seven direct artifacts, Compact, and Chromium executed successfully
• named-volume materialization and idempotent local-change preservation passed
• public-runtime payload audit passed
• Dockerized focused suite: 34 passed, 0 failed, 67 assertions
• workflow YAML parsing, Dockerfile BuildKit validation, and staged diff checks passed

Rollout notes

• set repository variable TEMPLATE_RUNTIME_RUNNER to a larger-runner label with at least 50 GiB initially free
• the first GHCR package is private; after the first candidate push, an organization owner must switch effectstream/template-runtime to Public and rerun
• no GHCR image was published from local validation
• registry-compressed size and hosted-runner peak remain to be recorded during the first manual publication
• the final permission-layer optimization passed BuildKit and focused validation; its additional cold local rebuild was stopped before capacity exhaustion because 31 GiB remained versus the measured approximately 46 GiB peak