CI: split runner-base RUN steps to avoid nginx upload timeout

Single combined layer was ~280MB and consistently failed to push with
499 (nginx closing connection). Split into three layers (~70-100MB each)
so each is pushed independently and stays within the timeout.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

infra/Dockerfile.runner-base

@@ -13,18 +13,23 @@ FROM ubuntu:24.04
 
 ENV DEBIAN_FRONTEND=noninteractive
 
+# Split into separate RUN steps so each pushed layer is smaller.
+# One combined layer would be ~280MB and exceeds the nginx upload timeout.
+
 # Python 3.12 ships in Ubuntu 24.04 main repos — no PPA needed.
-# Docker CLI is needed by docker/login-action and docker/build-push-action
-# (the daemon itself comes from the host socket mount).
 RUN apt-get update -qq && \
     apt-get install -y -qq \
       python3.12 python3.12-dev python3.12-venv python3-pip \
       git curl ca-certificates gnupg && \
-    # Node 22 LTS via NodeSource
+    apt-get clean && rm -rf /var/lib/apt/lists/*
-    curl -fsSL https://deb.nodesource.com/setup_22.x | bash - && \
+
+# Node 22 LTS via NodeSource
+RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - && \
     apt-get install -y -qq nodejs && \
-    # Docker CLI via Docker's official apt repo
+    apt-get clean && rm -rf /var/lib/apt/lists/*
-    install -m 0755 -d /etc/apt/keyrings && \
+
+# Docker CLI — daemon comes from the host socket mount, only CLI needed.
+RUN install -m 0755 -d /etc/apt/keyrings && \
     curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc && \
     chmod a+r /etc/apt/keyrings/docker.asc && \
     echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \