dunn.dev/pipeline 4.0.1

Fix: ci-runtime-go ships the CA trust bundle + tzdata.

The UBI-micro base shipped neither, so a static (CGO-off) Go binary doing
outbound TLS failed x509 verification on its first call -- caddy's Let's
Encrypt ACME + Cloudflare DNS-01, and bairn's Famly API (total-failure for
both). Every other ci-* image already installed ca-certificates on purpose;
ci-runtime-go was the outlier. Staged from a throwaway full-UBI builder;
final image stays package-manager-free (+3.5MB). ci-runtime-node unaffected
(Node uses its own compiled-in root store).

Adversarially verified pre-tag: the built image carries 146 valid PEM certs
(incl. ISRG Root X1/X2) at Go's x509 paths.