ci: add custom ARC runner image with build+push pipeline

In this commit, we add a darepo-specific GitHub Actions runner image
plus the workflow that builds and publishes it to GHCR. The image is
based on summerwind/actions-runner-dind so the runner pod gets a
working Docker daemon, and layers on the build deps that darepo's
Makefile-driven CI needs (build-essential, make, postgresql-client,
sqlite3) along with a preinstalled Go matching the GO_VERSION pinned
in main.yml.

The first head-to-head run against the new ARC self-hosted pool
exposed two image-level blockers on the upstream summerwind image:
"make: command not found" on every Makefile-driven step, and EACCES
on /opt/hostedtoolcache when actions/setup-go tried to drop the Go
toolchain. Patching every job with apt-installs and chowns is the
wrong level to fix this. Baking a single darepo-runner image keeps
the workflows clean and gives every job a fast-start runner with the
toolchain already in the cache.

The runner-image.yml workflow stays on ubuntu-latest (GitHub-hosted)
because we can't use ARC to build the ARC image while the cluster is
still on the stock summerwind image. PRs validate the Dockerfile by
building but skip the push; main pushes :latest plus :sha-<short>.

Once this is merged and the first :latest tag is published, the
RunnerDeployment in lightning-infra needs to point its image at
ghcr.io/lightninglabs/darepo-runner:latest and set
dockerdWithinRunnerContainer: true. Without that pairing the
runs-on: [self-hosted] jobs will keep failing the same way.

Author: Roasbeef

.github/runner-image/Dockerfile

@@ -0,0 +1,57 @@
+# Custom GitHub Actions runner image for darepo CI on the ARC self-hosted
+# pool. Based on summerwind/actions-runner-dind which gives us a working
+# Docker daemon inside the runner container; we layer on the build toolchain,
+# system deps, and a preinstalled Go that darepo's Makefile-driven CI needs.
+#
+# Built and pushed to ghcr.io/lightninglabs/darepo-runner via the
+# .github/workflows/runner-image.yml workflow. The lightning-infra
+# RunnerDeployment must reference this image and enable dockerd inside the
+# runner pod.
+
+ARG BASE_IMAGE=summerwind/actions-runner-dind:latest
+FROM ${BASE_IMAGE}
+
+# Pinned Go version. Keep in sync with GO_VERSION in the project Makefile and
+# .github/workflows/main.yml so actions/setup-go finds the preinstalled
+# toolchain in the cache instead of re-downloading on every job.
+ARG GO_VERSION=1.25.5
+
+USER root
+
+# Build toolchain and runtime deps for darepo's Makefile and test harness.
+# build-essential covers gcc/g++/libc-dev for any cgo paths; postgresql-client
+# is used by systest with the postgres backend; sqlite3 for the sqlite
+# backend.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+        build-essential \
+        ca-certificates \
+        curl \
+        git \
+        make \
+        pkg-config \
+        postgresql-client \
+        sqlite3 \
+ && apt-get clean \
+ && rm -rf /var/lib/apt/lists/*
+
+# Preinstall Go into the same path actions/setup-go writes to, so the action
+# treats it as a cache hit and skips downloading. Layout per setup-go on
+# Linux: /opt/hostedtoolcache/go/<version>/<arch>, with a sibling
+# <arch>.complete marker file. Cache arch is x64 for amd64 hosts and arm64
+# for arm64.
+RUN set -eux; \
+    ARCH="$(dpkg --print-architecture)"; \
+    case "${ARCH}" in \
+        amd64) GO_ARCH=amd64; CACHE_ARCH=x64 ;; \
+        arm64) GO_ARCH=arm64; CACHE_ARCH=arm64 ;; \
+        *) echo "unsupported arch ${ARCH}" >&2; exit 1 ;; \
+    esac; \
+    curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-${GO_ARCH}.tar.gz" -o /tmp/go.tgz; \
+    mkdir -p "/opt/hostedtoolcache/go/${GO_VERSION}/${CACHE_ARCH}"; \
+    tar -C "/opt/hostedtoolcache/go/${GO_VERSION}/${CACHE_ARCH}" --strip-components=1 -xzf /tmp/go.tgz; \
+    touch "/opt/hostedtoolcache/go/${GO_VERSION}/${CACHE_ARCH}.complete"; \
+    rm -f /tmp/go.tgz; \
+    chown -R runner:runner /opt/hostedtoolcache
+
+USER runner

.github/runner-image/README.md

@@ -0,0 +1,46 @@
+# darepo CI runner image
+
+Custom GitHub Actions runner image for the ARC self-hosted pool that runs
+darepo CI. Based on `summerwind/actions-runner-dind` and layered with the
+build toolchain (`make`, `build-essential`), database clients
+(`postgresql-client`, `sqlite3`), and a preinstalled Go matching the version
+pinned in [`main.yml`](../workflows/main.yml).
+
+## Why this exists
+
+The upstream `summerwind/actions-runner` image is intentionally lean: no
+`make`, no compilers, and `/opt/hostedtoolcache` is owned by root so
+`actions/setup-go` fails with `EACCES` when it tries to drop the toolchain.
+Patching every workflow job with apt-installs and chowns is the wrong level
+to fix this; baking a darepo-specific image keeps the workflows clean and
+gives every job a fast-start runner.
+
+## Build and publish
+
+[`.github/workflows/runner-image.yml`](../workflows/runner-image.yml) builds
+and pushes to `ghcr.io/lightninglabs/darepo-runner` on every change to this
+directory or the workflow itself. Tags:
+
+  - `ghcr.io/lightninglabs/darepo-runner:latest` on `main`
+  - `ghcr.io/lightninglabs/darepo-runner:sha-<short>` on every build
+
+Pull requests build the image to validate the Dockerfile but do not push.
+
+## Wiring it into the cluster
+
+The `RunnerDeployment` in
+[`lightning-infra/charts/actions-runner-controller/runners-staging.yaml`](https://github.com/lightninglabs/lightning-infra/blob/main/charts/actions-runner-controller/runners-staging.yaml)
+needs to point at this image and enable dockerd inside the runner pod:
+
+```yaml
+spec:
+  replicas: 1
+  template:
+    spec:
+      organization: lightninglabs
+      image: ghcr.io/lightninglabs/darepo-runner:latest
+      dockerdWithinRunnerContainer: true
+```
+
+If the `darepo-runner` package on GHCR is private, the namespace also needs
+a pull secret referenced via `imagePullSecrets`.

.github/workflows/runner-image.yml

@@ -0,0 +1,78 @@
+name: Runner image
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - '.github/runner-image/**'
+      - '.github/workflows/runner-image.yml'
+  pull_request:
+    paths:
+      - '.github/runner-image/**'
+      - '.github/workflows/runner-image.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+defaults:
+  run:
+    shell: bash
+
+env:
+  IMAGE: ghcr.io/lightninglabs/darepo-runner
+
+jobs:
+  build:
+    name: Build and push runner image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up QEMU
+        uses: lightninglabs/gh-actions/setup-qemu-action@2021.01.25.00
+
+      - name: Set up Docker Buildx
+        uses: lightninglabs/gh-actions/setup-buildx-action@2021.01.25.00
+
+      - name: Git checkout
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Log in to GHCR
+        if: github.event_name != 'pull_request'
+        uses: lightninglabs/gh-actions/login-action@2021.01.25.00
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Compute image tags
+        id: tags
+        run: |
+          set -euo pipefail
+          SHORT_SHA="$(git rev-parse --short=7 HEAD)"
+          TAGS="${IMAGE}:sha-${SHORT_SHA}"
+          if [[ "${GITHUB_REF}" == "refs/heads/main" ]]; then
+            TAGS="${TAGS}
+          ${IMAGE}:latest"
+          fi
+          {
+            echo "tags<<EOF"
+            echo "${TAGS}"
+            echo "EOF"
+          } >> "${GITHUB_OUTPUT}"
+
+      - name: Build and push runner image
+        id: build
+        uses: lightninglabs/gh-actions/build-push-action@2021.01.25.00
+        with:
+          context: .github/runner-image
+          # PRs validate the build but don't push to ghcr.
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.tags.outputs.tags }}
+
+      - name: Image digest
+        if: github.event_name != 'pull_request'
+        run: echo "darepo-runner: ${{ steps.build.outputs.digest }}"