[Kevin Cho (chokevin)]

Project Signal did not have a standalone, publishable baseline execution image on main. This adds that environment and wires it into existing local, CI, and tag-driven image paths, without adding certification orchestration or mutating a cluster.

• Adds a digest-pinned Ubuntu Noble image with Bash/core utilities, network and RDMA diagnostics, OpenMPI, SSH, and NVIDIA runtime-injected compute,utility capabilities.
• Keeps the execution environment deliberately minimal: no CUDA Toolkit, NCCL tests, certification scripts, APIs, controllers, adapters, or deployment manifests.
• Builds the image without publishing on native amd64 and arm64 CI runners. No runtime smoke test is included.
• Adds SIGNAL_RUNNER_IMAGE and image-project-signal-runner-local for local builds.
• Documents contents, exclusions, digest updates, local builds, and the existing images/project-signal-runner/<version> GHCR publishing path. The generic .github/workflows/images.yaml publisher already handles this image, so no additional publishing workflow is added.

Verification

• Passed: make lint-actions
• Passed: make help includes image-project-signal-runner-local
• Passed: make -n image-project-signal-runner-local CONTAINER_ENGINE=echo TRIVY=
• Passed: git diff --check
• Passed: required Ubuntu Noble packages resolve from main/universe indexes for amd64 and arm64
• Passed: the pinned Ubuntu digest resolves to a multi-arch manifest containing linux/amd64 and linux/arm64
• Passed: Containerfile matches the reviewed feat(signal): run one production 15-check certification workflow #963 source snapshot at 2fbc61f2bc13cf029cb17db8d8e9e9aaf1eaa798
• Unable to verify locally: a full image build, because Podman is not installed and the local Docker daemon is unavailable. The added CI matrix performs native builds on both architectures.

Risk

The change only publishes a reusable execution environment. It does not run checks, install controllers, create Kubernetes resources, or otherwise mutate a cluster. Required tool availability is checked during the image build; rollback is removal or replacement of the published image tag.

AI assistance: GitHub Copilot helped implement, validate, and draft this change; the author verified the diff, commands, claims, and final text.