Summary

• Commit src/runner/prepare.rs (previously untracked) and declare pub mod prepare in src/runner/mod.rs.
• In execute_job, read the prepare array from the job JSON; when non-empty, call prepare::prepare_image(image, &prepare, &log_reporter) and use the returned tag for executor::execute.
• Fail loudly if prepare is requested but can’t run (e.g. prepare without image, or docker commit error). Silent fallback to the bare base image is what produced the exit-127 failure on main.
• Call prepare::prune_prepared_images(30, 10) once at runner start to keep cached images under control.

Why

The server has been sending prepare: [...] in every job JSON, and the pipeline parser has validated the block since Mar 14. The runner never implemented the counterpart — the prepare field was read nowhere. Production CI only worked because carl had a locally-built binary with an uncommitted prepare.rs wired in. install.sh migrating carl to the latest CalVer release silently traded that away, and the next main run failed with exit 127 because git config couldn’t run in the bare hexpm/elixir image.

Test plan

• cargo build –release — clean
• cargo test — 6 passed (4 new prepare tests)
• cargo clippy –all-targets – -D warnings — clean
• cargo fmt – –check — clean
• Cut a new CalVer release from this branch.
• Reinstall runner on carl and re-run the failing deps job for main — deps should now pass via a freshly-built prepared image.

Closes #49