test-build: add --pull to refresh a stale local image

require_image pulled only when the image was missing, so once the
image-builder rebuilt a registry tag the local copy went stale with no
warning. --pull runs `docker pull` first, which compares digests itself
and costs one manifest request when nothing changed. If the registry is
unreachable it falls back to the local copy with a warning, and still
fails when there is none.

The README documents a daily cron pull for machines that run test-build,
and the skill notes that local images are not refreshed automatically.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

0 files changed, 0 insertions, 0 deletions