📝 Cancel force-pull task and document the runner-image decision

The act-ci image is rebuilt only when Node is bumped, which changes the
tag, so the runner's default no-force-pull behavior already picks up every
normal update. Forcing a pull would re-pull on every job and a missed
runner-side image change is acceptable, so document that decision as a
known issue with a manual docker rmi workaround instead of tracking a
force-pull task.

backlog.tasks

@@ -53,8 +53,8 @@ Maintenance:
     ✔ Write the `<version>/x64.complete` marker — actions/tool-cache ignores a bare directory, so the probe missed and the download continued @done
     ✔ Log tool-cache state from the job container to find it (temporary, removed once understood) @done
     ✔ Guard the invariant in CI (`Assert the baked tool cache is present`) @done
-☐ Enable force-pull for the runner so a changed act-ci image is never missed @low
-    → the tag encodes only the Node version, so a Dockerfile change yields new content under an unchanged tag; with `forcePull=false` the runner keeps the old image (see CONTRIBUTING § CI runner image)
+✘ Enable force-pull for the runner so a changed act-ci image is never missed @low @cancelled
+    → decided against: it is acceptable to miss a runner-side image change, and the image is only rebuilt on a Node bump, which changes the tag anyway. A Dockerfile-only change re-pushed under an unchanged tag is a known issue with a manual `docker rmi` workaround (see CONTRIBUTING § CI runner image).
 ✔ Improve CI publish @done
     ✔ Check whether publish job is only run on tags, if not, guard it @done
     ✔ Gate only single steps @done