feat(container): add build source to manifest schema

ContainerConfig.image is now Option<String>, mutually exclusive with a new
optional ContainerConfig.build: Option<BuildConfig>. Exactly one of image
or build must be present, enforced in AppManifest::validate.

Adds ResolvedSource enum (Pull | Build) and ContainerConfig::resolve +
::image_ref helpers so the orchestrator can treat pull and build uniformly.
All 26 existing pull-only manifests continue to parse unchanged
(covered by existing_pull_only_manifests_still_parse test).

Call sites updated: podman_client, runtime::DockerRuntime, dev_orchestrator.
Dev orchestrator errors out cleanly on Build sources until Step 2 lands
build_image support on the runtime trait.

Step 1 of docs/rust-orchestrator-migration.md. 10 new unit tests, all pass.

Also includes: docs/rust-orchestrator-migration.md (design spec) and
docs/STATUS.md resume section for the next session.

core/container/src/dependency_resolver.rs

@@ -213,9 +213,10 @@ mod tests {
                 version: "1.0.0".to_string(),
                 description: None,
                 container: ContainerConfig {
-                    image: format!("test/{}:latest", id),
+                    image: Some(format!("test/{}:latest", id)),
                     image_signature: None,
                     pull_policy: "if-not-present".to_string(),
+                    build: None,
                 },
                 dependencies: deps,
                 resources: Default::default(),