An ephemeral runner image misses the internal CA root and only private registry pulls fail after autoscaling adds new workers

Legacy workers continue working, but new ones cannot trust the organization registry chain.