feat: add shared runner Dockerfile and document rebuild process

All wiki pipelines share novoyuuparosk-wiki-runner:latest — a
locally-built image with git, pandoc, ca-certificates, and Python
packages pre-installed. Eliminates the apt-get and pip install
steps from every job run. Rebuild manually on the Pi when deps change.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,8 @@
+FROM python:3.12-slim
+
+RUN apt-get update -qq \
+    && apt-get install -y --no-install-recommends git pandoc ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY pipelines/songs/requirements.txt /tmp/songs-requirements.txt
+RUN pip install --no-cache-dir -r /tmp/songs-requirements.txt

README.md

@@ -48,6 +48,17 @@ One `act_runner` instance serves all pipelines. Runs on a Pi 5 (Raspberry Pi OS
 
 Container network mode: `host` — required so job containers can reach `localhost:3005` (Gitea) and resolve mDNS hostnames.
 
+### Job container image
+
+All pipelines share a single pre-built Docker image: `novoyuuparosk-wiki-runner:latest`. The `Dockerfile` is at the repo root. It bakes in system deps (git, pandoc, ca-certificates) and all pipeline Python packages so job containers start instantly with no install steps.
+
+The image is built manually on the Pi and stored in the local Docker daemon (`pull_image: false` in act_runner config). Rebuild after any change to the `Dockerfile` or a pipeline `requirements.txt`:
+
+```bash
+docker build -t novoyuuparosk-wiki-runner:latest \
+  /home/mikkeli/dev/novoyuuparosk-auto-wiki
+```
+
 ## Gitea Actions setup (cross-cutting)
 
 Secrets and variables are scoped to user `mikkeli` (no orgs on this instance), inherited by all repos under that account.