fix: align with base image layout so runners register; runner 2.338.0

[vaggeliskls]

Current Behaviour

The published image boots a Windows VM but never registers a runner.

The base image (windows-in-docker-container) moved to WORKDIR /app with its own /app/startup.sh and /app/Vagrantfile. This repo's Dockerfile still copied to /Vagrantfile.tmp and /startup.sh. At runtime our startup script ran from /app, found the base image's generic /app/Vagrantfile, skipped the envsubst step, and vagrant up provisioned a plain VM — no runner download, no config.cmd, no VS/Rtools.

Verified against the registry rather than inferred: the config of docker.io/vaggeliskls/windows-github-custom-runner:1.2.0 has WorkingDir: /app, the base's COPY --chmod=755 startup.sh Vagrantfile /app/ layer, and our ENTRYPOINT ["/startup.sh"] on top.

Secondary issues:

• Every container start registered RUNNERS runners with fresh random names and never removed the old ones, so --replace could never match and offline duplicates accumulated in the org.
• vs_enterprise.exe --quiet was not awaited, so runners could register while Visual Studio was still installing.
• Base image pinned to :latest; docker-compose.yml used the obsolete version: key and lacked cgroup: host; .env (which holds the PAT) was tracked with an empty .gitignore; README had a truncated sentence and v1 docker-compose commands.

Expected Behaviour

• Image follows the base image's pattern: the Vagrantfile reads its settings from ENV in Ruby and is copied straight to /app/Vagrantfile; the base /app/startup.sh (libvirtd readiness wait, QEMU fallback, graceful vagrant halt on SIGTERM) is reused. startup.sh, envsubst, the variable allow-list and the DOLLAR/RANDOM_STR leftovers are gone. Dockerfile is now FROM + ENV + one COPY.
• RDP (3389) and SSH (2222) forwarded like the base image; unused 445 forward and private_network dropped.
• Runner names are stable: <GITHUB_RUNNER_NAME>_<container hostname>_<n>, so --replace takes over existing registrations on restart. hostname: is set in the compose file.
• VS bootstrapper runs with --wait --norestart under Start-Process -Wait.
• Runner download URL derived from GITHUB_RUNNER_VERSION in the Vagrantfile, so the version (and name/labels) can be overridden from .env without a rebuild.
• GitHub runner 2.334.0 → 2.338.0; base image pinned to 1.0.1; actions/checkout v6 → v7 (the docker/* actions are already on their latest majors).
• New lint.yml on PRs: hadolint, ruby -c Vagrantfile, actionlint. New dependabot.yml for GitHub Actions and the base image tag. Release workflow gets an explicit permissions block.
• .env.example tracked, .env and .vagrant/ ignored. README rewritten: KVM/cgroup prerequisites, variable table, runner naming, VM contents with a VS Enterprise licensing note, SSH access, development notes.

Unchanged on purpose: VS 2022 Enterprise / NativeDesktop workload and Rtools 4.0 — product choices, flagged in the README.

Verification

• ruby -c Vagrantfile OK; rendered the provisioning script through a stub Vagrant DSL with sample env to check interpolation and backslash escaping (single backslashes, correct runner names/URL/auth, abort messages fire when RUNNER_URL or PAT/TOKEN are missing).
• hadolint v2.15.1 and actionlint 1.7.12 clean; docker compose config valid.
• Runner zip URL for 2.338.0 returns HTTP 200.
• Not done: a full docker compose up on a KVM host — please run one before cutting the release if you have a box handy.