The PULL_IMAGE deploy stage was a no-op — Docker only pulls on create if the image is missing entirely, not when a newer version exists. DeploymentExecutor now calls orchestrator.pullImage() to fetch the latest base image from the registry before creating containers. Also fixes the default base image from 'cameleer-runtime-base:latest' (local-only name) to the fully qualified registry path 'gitea.siegeln.net/cameleer/cameleer-runtime-base:latest'. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>