chore: add Dockerfile for self-hosted runner with pre-built uv cache

[timzsu]

Purpose

Land a Dockerfile that builds a custom self-hosted runner image with the uv wheel cache pre-populated for the project's --all-extras install. Once the runner hosts use this image, CI workflows that run uv sync --all-extras --frozen warm-hit the cache instead of redownloading every wheel.

The previous attempt at speeding up CI used astral-sh/setup-uv@v7's GHA-cache integration. That doesn't work for a --all-extras install: uv cache prune --ci strips the cache to ~2.7 MB, GHA Actions Cache caps at 10 GB per repo (and the unpruned cache is ~10.4 GB), and a shared host-mounted writable cache would be a poisoning vector. A pre-baked image side-steps all three: cache lives in the image's read-only layers, externally managed (rebuild on schedule), no per-run management.

Changes

• .github/runners/Dockerfile — bases on myoung34/github-runner:latest, installs a pinned UV_VERSION (default 0.11.8), COPYs the build context into /tmp/flowmesh, runs uv sync --all-extras --frozen to populate /root/.cache/uv, then deletes the source tree. Only the populated cache survives in the image.
• .github/runners/README.md — build command, deployment to runner hosts (image tag swap in the systemd units + systemctl restart), refresh cadence (rebuild on uv.lock changes or UV_VERSION bumps), and the workflow-side change required (pin setup-uv's version: to match UV_VERSION, set enable-cache: false).
• .dockerignore — adds .claude/ and .pr-body.md so local agent state and PR-body drafts never bake into any image build.

Design

Why COPY rather than git clone: FlowMesh is private. Cloning at build time would require either an SSH key forwarded via BuildKit or a token in a build secret. Using the build context (the maintainer's local checkout) avoids both, and the pattern is "build it from the same place you'd run uv sync manually."

Why pin UV_VERSION: uv changes its cache layout across minor versions. If the image bakes uv 0.11.8 but CI's setup-uv resolves uv 0.12.x, the cache may not be readable and CI falls through to a cold install. Pinning both sides (image build arg + workflow version:) keeps them aligned.

Cache freshness: rebuild when uv.lock changes on main. Stale cache is not unsafe — uv falls through to network for any wheel it doesn't find — just slower until the rebuild.

Test Plan

# Build locally to verify the Dockerfile is correct
git checkout main && git pull
docker build \
  --build-arg UV_VERSION=0.11.8 \
  -t flowmesh-oss-ci-runner:test \
  -f .github/runners/Dockerfile \
  .

# Sanity-check the cache is non-empty and uv is the pinned version
docker run --rm flowmesh-oss-ci-runner:test sh -c 'uv --version && du -sh /root/.cache/uv'

Test Result

Build succeeds locally; the image's /root/.cache/uv is on the order of GB (the actual size depends on what --all-extras resolves to at the time of build).

---

Pre-submission Checklist

• I have read CONTRIBUTING.md (or AGENTS.md if no CONTRIBUTING.md).
• I have run uv run pre-commit run --all-files and fixed any issues.
• I have added or updated tests covering my changes (if applicable).
• I have verified that the test suite passes locally.
• If this is a breaking change, I have prefixed the PR title with [BREAKING] and described migration steps above.