feat: add runner-rust and runner-nodejs images

Both build FROM runner-fedora-43 (the base with act_runner + CA trust).

runner-rust: rust, cargo, gcc, pkg-config, openssl-devel
runner-nodejs: nodejs, npm

Manifest updated with all three images:
- runner-fedora-43: labels [fedora-43], 2 CPU / 2G
- runner-rust: labels [fedora-43, rust], 4 CPU / 4G
- runner-nodejs: labels [fedora-43, nodejs], 2 CPU / 2G

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

asset/manifest.yml

@@ -23,3 +23,13 @@ environments:
         labels: [fedora-43]
         cpu_request: 2
         mem_request_mb: 2048
+      - name: runner-rust
+        image_ref: git.lair.cafe/gongfoo/runner-rust:latest
+        labels: [fedora-43, rust]
+        cpu_request: 4
+        mem_request_mb: 4096
+      - name: runner-nodejs
+        image_ref: git.lair.cafe/gongfoo/runner-nodejs:latest
+        labels: [fedora-43, nodejs]
+        cpu_request: 2
+        mem_request_mb: 2048

images/runner-fedora-43/root-internal.pem

@@ -1,2 +1,11 @@
-Replace this file with the internal CA root certificate before building.
-Copy from: /etc/pki/ca-trust/source/anchors/root-internal.pem
+-----BEGIN CERTIFICATE-----
+MIIBjjCCATWgAwIBAgIQPkRfa3ZkA+r+gQ2te8dNbTAKBggqhkjOPQQDAjAmMQ0w
+CwYDVQQKEwRsYWlyMRUwEwYDVQQDEwxsYWlyIFJvb3QgQ0EwHhcNMjYwMzA3MTUy
+NTUwWhcNMzYwMzA0MTUyNTUwWjAmMQ0wCwYDVQQKEwRsYWlyMRUwEwYDVQQDEwxs
+YWlyIFJvb3QgQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATM45LBE4kseHqG
+I+WD5oFb47pjMwoDfh0gLe1Gl8y5zAxyA7m2rRwKH3nt5HZ757FmIZdM9s9reD4O
+0En5BxOPo0UwQzAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAd
+BgNVHQ4EFgQU3xP26oOksnAGjmHWcNXCUYXXVxMwCgYIKoZIzj0EAwIDRwAwRAIg
+TW5OBA1gBpPp6E+nGDt9/CHfiCaH81oJenMh0FvMoswCIDcfYHi6z4MYzSyvPr/g
+1ZW21Bc1Qkowe4jjx4COEzQc
+-----END CERTIFICATE-----

images/runner-nodejs/Containerfile

@@ -0,0 +1,6 @@
+FROM git.lair.cafe/gongfoo/runner-fedora-43:latest
+
+RUN dnf install -y --setopt=install_weak_deps=False \
+        nodejs \
+        npm \
+    && dnf clean all

images/runner-nodejs/build.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REGISTRY="${REGISTRY:-git.lair.cafe}"
+IMAGE_NAME="${REGISTRY}/gongfoo/runner-nodejs"
+TAG="${TAG:-latest}"
+
+podman build -t "${IMAGE_NAME}:${TAG}" -f "${SCRIPT_DIR}/Containerfile" "$SCRIPT_DIR"
+echo "built ${IMAGE_NAME}:${TAG}"
+
+echo "push with: podman push ${IMAGE_NAME}:${TAG}"

images/runner-rust/Containerfile

@@ -0,0 +1,9 @@
+FROM git.lair.cafe/gongfoo/runner-fedora-43:latest
+
+RUN dnf install -y --setopt=install_weak_deps=False \
+        rust \
+        cargo \
+        gcc \
+        pkg-config \
+        openssl-devel \
+    && dnf clean all

images/runner-rust/build.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REGISTRY="${REGISTRY:-git.lair.cafe}"
+IMAGE_NAME="${REGISTRY}/gongfoo/runner-rust"
+TAG="${TAG:-latest}"
+
+podman build -t "${IMAGE_NAME}:${TAG}" -f "${SCRIPT_DIR}/Containerfile" "$SCRIPT_DIR"
+echo "built ${IMAGE_NAME}:${TAG}"
+
+echo "push with: podman push ${IMAGE_NAME}:${TAG}"