CID-verified image retrieval

[shivv23]

Before pulling a Docker image, verify its CID matches the on-chain deal commitment from the V2 contract. If the CID doesn't match or no active deal exists, the scheduler should reject the image and emit a warning event.