fix: pull base image on deploy and fix registry prefix default

The PULL_IMAGE deploy stage was a no-op — Docker only pulls on create
if the image is missing entirely, not when a newer version exists.
DeploymentExecutor now calls orchestrator.pullImage() to fetch the
latest base image from the registry before creating containers.

Also fixes the default base image from 'cameleer-runtime-base:latest'
(local-only name) to the fully qualified registry path
'gitea.siegeln.net/cameleer/cameleer-runtime-base:latest'.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cameleer3-server-app/src/main/java/com/cameleer3/server/app/runtime/DeploymentExecutor.java

@@ -29,7 +29,7 @@ public class DeploymentExecutor {
     @Autowired(required = false)
     private DockerNetworkManager networkManager;
 
-    @Value("${cameleer.server.runtime.baseimage:cameleer-runtime-base:latest}")
+    @Value("${cameleer.server.runtime.baseimage:gitea.siegeln.net/cameleer/cameleer-runtime-base:latest}")
     private String baseImage;
 
     @Value("${cameleer.server.runtime.dockernetwork:cameleer}")
@@ -133,7 +133,7 @@ public class DeploymentExecutor {
 
             // === PULL IMAGE ===
             updateStage(deployment.id(), DeployStage.PULL_IMAGE);
-            // Docker pulls on create if not present locally
+            orchestrator.pullImage(baseImage);
 
             // === CREATE NETWORKS ===
             updateStage(deployment.id(), DeployStage.CREATE_NETWORK);

cameleer3-server-app/src/main/java/com/cameleer3/server/app/runtime/DockerRuntimeOrchestrator.java

@@ -49,6 +49,20 @@ public class DockerRuntimeOrchestrator implements RuntimeOrchestrator {
         return true;
     }
 
+    @Override
+    public void pullImage(String image) {
+        try {
+            log.info("Pulling image {}", image);
+            dockerClient.pullImageCmd(image).start().awaitCompletion();
+            log.info("Image pulled: {}", image);
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+            log.warn("Image pull interrupted for {}", image);
+        } catch (Exception e) {
+            log.warn("Failed to pull image {} (will use local cache if available): {}", image, e.getMessage());
+        }
+    }
+
     @Override
     public String startContainer(ContainerRequest request) {
         List<String> envList = request.envVars().entrySet().stream()

cameleer3-server-app/src/main/resources/application.yml

@@ -43,7 +43,7 @@ cameleer:
     runtime:
       enabled: ${CAMELEER_SERVER_RUNTIME_ENABLED:true}
       jarstoragepath: ${CAMELEER_SERVER_RUNTIME_JARSTORAGEPATH:/data/jars}
-      baseimage: ${CAMELEER_SERVER_RUNTIME_BASEIMAGE:cameleer-runtime-base:latest}
+      baseimage: ${CAMELEER_SERVER_RUNTIME_BASEIMAGE:gitea.siegeln.net/cameleer/cameleer-runtime-base:latest}
       dockernetwork: ${CAMELEER_SERVER_RUNTIME_DOCKERNETWORK:cameleer}
       agenthealthport: 9464
       healthchecktimeout: 60

cameleer3-server-core/src/main/java/com/cameleer3/server/core/runtime/RuntimeOrchestrator.java

@@ -4,6 +4,8 @@ import java.util.stream.Stream;
 
 public interface RuntimeOrchestrator {
     boolean isEnabled();
+    /** Pull the latest version of a container image from the registry. */
+    default void pullImage(String image) {}
     String startContainer(ContainerRequest request);
     void stopContainer(String containerId);
     void removeContainer(String containerId);