📝 Document CI runner-image bump ritual

build:runner-image broke the script prefix convention: build is a bare
single-tool command, and no tier fits a docker-daemon + registry-cred action,
so the script leaves package.json and is invoked directly. CONTRIBUTING gains
a 'CI runner image' section recording where the image pushes
(gitea.e1nsnull.de/tmu/act-ci:<version>), the .node-version coupling, and the
three-step Node-bump ritual.

.gitea/workflows/ci.yml

@@ -52,9 +52,9 @@ jobs:
         # `image` extends the runner's default job image (catthehacker/act)
         # with Node 26 pre-planted in the tool cache layout, so setup-node's
         # version probe hits and never downloads (see docker/Dockerfile). The
-        # tag MUST equal the exact version pinned in `.node-version`; rebuild
-        # via `npm run build:runner-image -- --push` and repoint here on every
-        # Node bump. The volume bind-mounts the shared pages tree so the
+        # tag MUST equal the exact version pinned in `.node-version`; the bump
+        # ritual is documented in CONTRIBUTING.md § CI runner image. The volume
+        # bind-mounts the shared pages tree so the
         # coverage step below can write into it; the runner whitelists this
         # path via `container.valid_volumes` (docker-space `setup/gitea.sh`).
         container: