CI: keep shared-runner overflow compatible with image pull policies

Problem

Untagged jobs can land on either the Hetzner Docker runners or GitLab.com instance runners. The current single if-not-present policy is rejected by instance runners, while integration-test requires the Hetzner Docker socket.

Definition of done

• General jobs support both runner fleets without pull-policy configuration errors.
• Hetzner runners retain cached-image behavior where permitted.
• integration-test is pinned to the Hetzner Docker runners.
• The MR pipeline is green on the final head.