Empirically verified (run on a fedora-43 runner): the ssh client is present
on every runner image, not just `infra`. The bare fedora/ubuntu container base
ships no ssh and weak deps are disabled, but each image installs `git` for
checkout, and `git-core` hard-requires `openssh-clients` — so ssh is pulled in
regardless. rsync + curl are likewise in every base.
Corrects the earlier claim that CI-driven deploy needs `infra`: deploy jobs
run fine on `fedora-43`. `infra`'s real payload is `stalwart-cli` / infra
service CLIs. Also notes that runner-infra's own Containerfile comment
("the ssh client is not in the base") is misleading.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016fKZzDpvjiJ9eYbPGgJvUP
Document the gongfoo-managed runner images (labels, lineage, toolchains,
CPU/MEM), how `runs-on:` label matching selects one, which runner to pick for
each job type, and how to add/extend an image instead of installing packages
at workflow run time.
Captures the traps that cost a run: `fedora-*` has no cargo (use `rust`); the
base fedora images ship rsync but no ssh client (deploy jobs use `infra`);
`corepack` isn't bundled — pnpm is preinstalled via npm, call it directly.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016fKZzDpvjiJ9eYbPGgJvUP
