Document the gongfoo-managed runner images (labels, lineage, toolchains,
CPU/MEM), how `runs-on:` label matching selects one, which runner to pick for
each job type, and how to add/extend an image instead of installing packages
at workflow run time.
Captures the traps that cost a run: `fedora-*` has no cargo (use `rust`); the
base fedora images ship rsync but no ssh client (deploy jobs use `infra`);
`corepack` isn't bundled — pnpm is preinstalled via npm, call it directly.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016fKZzDpvjiJ9eYbPGgJvUP
