Fix exact runtime-image builder cleanup

[omkhar]

Summary

• move temporary Buildx lifecycle into the host Go policy boundary with random ownership identities
• bind cleanup to the exact Docker endpoint and immutable container/volume identities
• select the claimed builder explicitly and clean it after every build attempt
• add retry, replacement, and live Colima/Docker Desktop cleanup evidence

Validation

• three local peer-review lenses: no actionable findings
• go test ./...
• go vet ./...
• go test -race ./internal/host/runtimebuilder
• tests/scenarios/shared/test-agent-launch-smoke.sh
• tests/scenarios/shared/test-docker-desktop-launch-smoke.sh
• ./scripts/pre-merge.sh --profile pr-parity

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6f976b1340

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".