ci/task-board: pin workflow container to node:20-bookworm-slim

Runner's .runner registration cached :host mode at first start; env-var
label updates aren't sticky once the runner is registered. Until we
re-register with docker-schema labels, workflows must declare their
own container. node:20-bookworm-slim has node (for actions/checkout)
and apt (for python3-yaml + openssh-client install).

stacks/task-board/gitea-workflow-deploy.yaml.example

@@ -36,12 +36,17 @@ jobs:
   deploy:
     # `pfi-fleet` matches the central runner on ana-docker. Pin to
     # `ana-docker` instead if you want to refuse running on a future
-    # site-local runner. The runner's label embeds a default image
-    # (node:20-bookworm-slim) — has node + git out of the box, so
-    # actions/checkout@v4 (a JS action) works without a custom
-    # container. We just apt-install python3 + pyyaml for elway.
+    # site-local runner.
     runs-on: pfi-fleet
 
+    # Explicit container is required until the runner is re-registered
+    # with docker-schema labels (the initial `.runner` registration
+    # cached `:host` mode and that's sticky). node:20-bookworm-slim is
+    # ~150 MB, has node (so actions/checkout@v4 works) + apt
+    # (so we can install python3 + pyyaml for elway).
+    container:
+      image: node:20-bookworm-slim
+
     steps:
       - name: Install playbook prerequisites
         run: |