Release Docker Sandboxes recovery hardening and v0.42.1 compatibility

[joecklau]

Summary

Promote develop to main, including the changes merged in #44:

• Durable host-wide Docker Sandboxes recovery coordination and capacity-preserving lifecycle reconciliation.
• Independent exact-absence verification for historical identities and clearer redacted provisioning errors.
• Compatibility with the inert SSH-agent environment injected by sbx v0.42.1 while retaining checks against real forwarding endpoints.
• Complete file-based local-build SBOM export and validation without BuildKit attestation size limits.
• Regression coverage and operational/security documentation.

Validation carried forward from #44

• Relevant Go test packages passed: internal/image, internal/pool, internal/provider/dockersandboxes, internal/prebuilt, and cmd/epar-prebuilt-publisher.
• Fixed local Full arm64 template built and passed live admission on sbx v0.42.1.
• Two-runner lifecycle verification covered replacement and cleanup.
• Operator confirmed three successful CI jobs with recycling and replacement using the fixed local image.

Post-merge verification

• Explicitly dispatch the Docker Sandboxes image-publication workflow with profile full on main; a push defaults to Act and does not rebuild the configured full-latest image.
• Confirm publication actually advanced full-latest rather than being skipped by upstream gates.
• Refresh the normal prebuilt configuration and repeat CI/recycling verification against the published image.

Separate follow-ups

• Startup host-trust refresh cancellation warning remains under separate consideration.
• September 2–8 resource-exhaustion concerns are not claimed resolved.

No published-image compatibility result is claimed yet. This PR includes the two implementation commits and the #44 merge commit.