fix: pull base image on deploy and fix registry prefix default

The PULL_IMAGE deploy stage was a no-op — Docker only pulls on create
if the image is missing entirely, not when a newer version exists.
DeploymentExecutor now calls orchestrator.pullImage() to fetch the
latest base image from the registry before creating containers.

Also fixes the default base image from 'cameleer-runtime-base:latest'
(local-only name) to the fully qualified registry path
'gitea.siegeln.net/cameleer/cameleer-runtime-base:latest'.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cameleer3-server-core/src/main/java/com/cameleer3/server/core/runtime/RuntimeOrchestrator.java

@@ -4,6 +4,8 @@ import java.util.stream.Stream;
 
 public interface RuntimeOrchestrator {
     boolean isEnabled();
+    /** Pull the latest version of a container image from the registry. */
+    default void pullImage(String image) {}
     String startContainer(ContainerRequest request);
     void stopContainer(String containerId);
     void removeContainer(String containerId);