Support custom container images for containerized runners

[nicktallen]

Problem

Container isolation mode currently uses a default Linux image. Users may need custom images with specific tools, libraries, or configurations pre-installed.

Proposed Solution

Allow users to specify a custom OCI container image when creating a runner with container isolation:

mac-runner add owner/repo --isolation container --image ghcr.io/myorg/runner-image:latest

Acceptance Criteria

• Accept --image flag in CLI for container isolation runners
• Image picker/text field in GUI Add Runner form
• Pull image from OCI registries (Docker Hub, GHCR, etc.)
• Cache pulled images locally
• Default image still works when no custom image specified
• Document supported image requirements (must have runner binary, etc.)

Notes

Listed in README under "Planned Features." Filing to track formally. Requires container isolation (macOS 26+, Apple Silicon).

[nicktallen]

Triage note — partial backend support exists

ContainerRunnerConfiguration already has a containerImage: String? field (line 290 of ContainerIsolationService.swift), and the container creation logic uses it (falls back to defaultRunnerImage when nil). However, per the acceptance criteria:

• CLI --image flag — not yet implemented (RunnerManager hardcodes containerImage: nil)
• GUI image picker — not in AddRunnerView
• Image pulling/caching — not implemented
• Documentation — not yet written

The backend plumbing is in place; this needs CLI arg parsing, UI, and image management.

---

Automated triage by mac-runner bot