docs(runner-images): stock images work; drop the "must extend the runner base" claim

[luthermonson]

docs/guides/runner-images.md:37 claimed "custom images must extend the upstream GitHub Actions runner base image", and line 12 asserted the same more quietly ("the runner binary lives inside the image").

Both are wrong, and the false premise had spawned three further errors.

What the code does — all three mechanisms verified

1. pkg/runner extracts the runner. go:embed all:embed at runner.go:18; Manager.Extract() at :64 unpacks to <data-dir>/runners/<version>-<goos> (:43). Fetched at build time by mage, SHA-pinned — never at runtime.
2. pkg/runtime bind-mounts it in. Per-job copy at runtime.go:952; withRunnerMount at :1514 mounts rbind,rw at /actions-runner (Linux) or an HCS mapped dir at C:\actions-runner (Windows). Entrypoint oci.WithProcessArgs("/actions-runner/run.sh", ...) at :930.
3. The Windows default has no runner. pkg/runtime/image_windows.go:9-13 returns bare mcr.microsoft.com/windows/servercore. Every Windows job already runs the stock-image path.

The decisive detail: customImage := image != "" && !isOfficialRunnerImage(image) (runtime.go:805). Deriving from the official base is the special case that suppresses the mount. Stock is the normal path.

Errors that followed from the false premise

• The Windows Dockerfile example and reference table cited ghcr.io/actions/actions-runner:latest-win, which does not exist. The doc had invented a Windows runner base because it believed one was required. The real base is mcr.microsoft.com/windows/servercore:ltsc2025.
• Per-repo override example used [runner.repo_images], not in the schema. Real shape is [runner.images.<repo>] with linux/windows keys (pkg/config/config.go:1357-1365).
• Stale images/ link pointed at a feature branch.

Real constraints, documented rather than hand-waved

Nothing runner-related, but genuine ones exist. Linux: /bin/bash (the mounted run.sh is #!/bin/bash, execved directly), and a glibc userland with libkrb5-3, zlib1g, liblttng-ust, libssl, libicu. musl/Alpine does not work — which also explains why the runner's bundled node20 will not run there. Node.js is not needed. No USER/WORKDIR is set and RUNNER_ALLOW_RUNASROOT=1, so root-by-default stock images are fine. Capability set excludes CAP_SYS_ADMIN/CAP_NET_ADMIN; /etc/hosts and /etc/resolv.conf are mounted read-only over whatever the image ships. Windows needs cmd.exe (Server Core, not Nano).

Added

golang:1.26.6-bookworm as a worked example — resolves arm64 natively from the same tag, and lets a project delete an entire run-time C-toolchain step.

Plus the gotcha: go build inside a container fails with error obtaining VCS status: exit status 128, and ${{ github.workspace }} is the host path so marking it safe does not work. git config --global --add safe.directory "*" is what works — documented with why the obvious fix fails (_work → /__w remap).

Also notes that the servercore default ships no Docker CLI (image_windows.go:12 vs images/runner-ci-windows/Dockerfile:86-89), so no docker in steps, no dind, no container:.