fix(romhacks): pull the orchestrator image instead of declaring a build

Point the service at registry.ginnoir.com/ginnoir/romhacks-orchestrator:latest
(built by the workflow added in 60121a5, verified pullable on valhalla) and
drop the `build:` context that Portainer never honoured.

This unfreezes stack 28, which has been stuck at 847edff since 2026-06-24:
the containers kept running, so nothing alerted, but no commit had deployed
in two months.

README: document that Portainer builds nothing here, and that re-adding a
`build:` would deadlock the stack again.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

stacks/romhacks/docker-compose.yml

@@ -26,12 +26,19 @@
 # DRY_RUN=true, so even if deployed it idles and never enqueues a download. See
 # README.md for the arming checklist.
 #
-# BUILD (not bind) for the orchestrator: Portainer git-stack checkouts do NOT
+# BAKED IMAGE (not bind) for the orchestrator: Portainer git-stack checkouts do NOT
 # reliably materialize sibling repo files at relative FILE bind paths (Docker then
 # auto-creates a directory — see the `share` stack note). So the orchestrator's
-# scripts + channels.json are baked into a built image from ./orchestrator instead
-# of bind-mounted. Editing channels.json => push => Portainer rebuild (use
-# "Re-pull and redeploy" if a content-only change doesn't trigger a rebuild).
+# scripts + channels.json are baked into an image built from ./orchestrator.
+#
+# That image is built by Gitea Actions and pushed to the self-hosted registry —
+# NOT by a compose `build:` context. Portainer's git auto-update only ever runs
+# `docker compose pull`, never `build`, so a `build:` + local-only `image:` name
+# froze this stack: every poll died on "pull access denied for
+# homelab/romhacks-orchestrator" and the stack never advanced past its last good
+# commit. Same pattern as famapp. See .gitea/workflows/build-romhacks-orchestrator.yml.
+# Editing channels.json or the scripts => push => the workflow rebuilds :latest,
+# and watchtower/the next redeploy picks it up.
 #
 # Tiered binds: working state (exports/state/crawljobs + JD config) -> /config
 # (SSD); bulk output + art -> /storage1/labdata/romhacks (ZFS, root-auto-created).
@@ -40,9 +47,8 @@
 
 services:
   romhacks:
-    build:
-      context: ./orchestrator
-    image: homelab/romhacks-orchestrator:latest
+    image: registry.ginnoir.com/ginnoir/romhacks-orchestrator:latest
+    pull_policy: always
     container_name: romhacks
     restart: unless-stopped
     networks: [romhacks]