[chore](trx-rs): force-pull the SDK image on the CI runner

The workflow references the SDK image by the moving `:latest` tag, and
act_runner skips the pull when a local copy of that tag already exists:
the job log reports `docker pull ... forcePull=false` followed by
`Image exists? true`.  Pushing a rebuilt image therefore changes nothing
until someone pulls on the VM by hand, and the run fails as though the
image never gained the tool that was added to the Containerfile —
`sccache` resolving as "No such file or directory" while the pinned
toolchain from an earlier build of the same tag resolves fine.

Set `force_pull: true` so a pushed image is what actually runs, and
document the manual refresh for runners configured before this change.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GdyUjuXejCEfiub675z6cz
Signed-off-by: Stan Grams <sjg@haxx.space>

container/runner-config.example.yaml

@@ -33,3 +33,9 @@ container:
   options: "--cpus=2 -v /var/cache/sccache:/sccache"
   # Reuse the host VM's Docker network for the built-in cache/artifact server.
   network: "host"
+  # The workflow pulls the SDK image by the moving `:latest` tag. Without this
+  # the runner logs "Image exists? true" and reuses whatever it cached the
+  # first time, so pushing a rebuilt image has no effect until someone pulls
+  # on the VM by hand — which looks like the image is missing a tool it in
+  # fact has. The extra registry round-trip per job is nothing next to a build.
+  force_pull: true