Pull the Arch image for tests and trackers from GHCR

The self-tests, the build-isolation fixture and the three tracker
workflows pulled archlinux:base-devel from Docker Hub without logging
in. On 2026-10-09 that failed two jobs on one pull request: one with
'toomanyrequests', one with a 504 from Docker Hub's token endpoint.

Arch publishes the same image as ghcr.io/archlinux/archlinux, which
GitHub's runners pull without that limit.

tests/build-isolation.Dockerfile

@@ -1,6 +1,6 @@
 # Only the build runner is under test; source-free fixtures need no Omarchy
 # bootstrap, signing key, mirror, or production repository.
-FROM archlinux:base-devel
+FROM ghcr.io/archlinux/archlinux:base-devel
 RUN pacman -Syu --noconfirm git jq sudo && \
     useradd -m -u 1000 builder && \
     echo 'builder ALL=(ALL) NOPASSWD: ALL' > /etc/sudoers.d/builder && \