The default task-runner image is not public

[eren23]

What happens: v1alpha1.DefaultTaskImage (pkg/apis/v1alpha1/types.go:38), examples/task.yaml, examples/simple.yaml, and demo.sh use gcr.io/ax-substrate/ate-images/ax-task-runner. An anonymous pull of this image returns 403 Forbidden. A task without spec.image fails on every cluster outside Google.

Reproduce:

docker buildx imagetools inspect gcr.io/ax-substrate/ate-images/ax-task-runner@sha256:3a0dea6ad8b55278685db58aca6e37dc4ba04056831d45bef3aaeafdca43cac6
# ERROR: ... 403 Forbidden

Suggested fix: Publish the runner image to a public registry for amd64 and arm64. Or document that users must build it (make push-task-runner), and add a controller flag for the default image.

Environment: google/ax d0bc38b and Agent Substrate 1d7ca8c, on a local kind cluster (Docker Desktop on Apple Silicon).

[ilaigold]

Still the case on v0.3.1 (e70162a). examples/task.yaml, examples/simple.yaml and DefaultTaskImage all point at gcr.io/ax-substrate/ate-images/ax-task-runner, and an anonymous pull is still refused today (failed to fetch anonymous token). On GKE (Standard 1.36.3-gke.1767000) with v0.3.0, the pull failed with artifactregistry.repositories.downloadArtifacts DENIED.

A workaround that works on v0.3.1:

1. Build cmd/ax-task-runner for your platform.
2. Push the image to your own registry.
3. Set spec.image pinned by digest. A tag reference fails, because Substrate rejects images that are not pinned by digest, and AX reports that as actor template not found (Custom ActorTemplate creation errors are swallowed; Task fails with misleading 'actor template not found' (e.g. tag-referenced image) #366).