service/ci.md: Link and recommend TPA-maintained images

It definitely seems like we should link to the images from here. I'm less sure to what degree we should recommend them, but figured I'd take a stab at it and let you correct me. e.g. I could imagine that if we're not settled on the repository layout, or eventually want to migrate to pointing the runners at a TPA-owned default image registry, then we might not want to broadly recommend this yet.