build: add pinned Daytona Pi runtime image

[nmogil]

Summary

• add a credential-free, digest-pinned Daytona runtime image definition
• provide Python 3.12.11, Node 22.19.0/npm 10.9.3, /bin/sh, and Pi exactly 0.80.6
• preserve the reviewed Pi npm alias and integrity-lock the production dependency graph
• constrain the Docker build context to four non-secret runtime files
• add local build/inspection scripts and exact runtime contract tests
• document immutable GHCR publication and digest-only Mogil/Daytona use

Verification

• real local Docker build passed
• runtime inspection passed
• pi --version produced exactly 0.80.6\n
• runtime contract tests: 3 passed
• non-Docker suite: 101 passed, 1 manually gated skip, 1 deselected
• Docker smoke: passed
• Ruff: passed
• mypy: passed
• shell syntax and git diff --check: passed

Security boundary

No credentials, auth files, task fixtures, repository source, or model secrets enter the build context or image. Publication is not automated by this PR; the reviewed image will be published deliberately and consumed only by immutable manifest digest.