fix(ci): 允许复用固定摘要的 Runner 镜像

本地已存在完全相同 digest 的 Runner 镜像时跳过外部拉取，继续执行二进制校验与隔离探针；仅在镜像缺失时访问仓库。

避免 Docker Hub 瞬时不可达导致专用 CI Runner 无法恢复。

scripts/provision-ci-runner.sh

@@ -192,7 +192,9 @@ GOBIN="$PREFIX/bin" GOPROXY="${GO_MODULE_PROXY:-https://goproxy.cn,direct}" \
   "$PREFIX/toolchains/go/bin/go" install golang.org/x/vuln/cmd/govulncheck@v1.6.0
 
 require_free_space "$MIN_FREE_GIB" "runner image pull"
-docker pull "$RUNNER_IMAGE_SOURCE"
+if ! docker image inspect "$RUNNER_IMAGE_SOURCE" >/dev/null 2>&1; then
+  docker pull "$RUNNER_IMAGE_SOURCE"
+fi
 runner_runtime_image=$(docker image inspect --format '{{.Id}}' "$RUNNER_IMAGE_SOURCE")
 printf '%s\n' "$runner_runtime_image" | grep -Eq '^sha256:[0-9a-f]{64}$' || \
   fail "pinned runner image did not resolve to an immutable local image ID"