Prune images and inspect Build Grants on the Machine#1664

Third PR of the Machine RPC catalog simplification. Image cleanup and Build Grant reads move onto the Machine. RemoveImages and EndBuildGrant go.

What changes

• PruneImages replaces RemoveImages. The Machine runs the list, superseded() and remove steps itself, so a caller sends repositories, not image references. The SDK's image cleanup checks the Machine's contract first and reports Unsupported when it lacks ployz.image.prune.v1.
• InspectBuildGrant replaces EndBuildGrant. Reading a grant reports what it pushed and how long it has left. It never ends or spends the grant. A push still spends it, and a spent grant refuses further registry calls.
• The GitHub build finish step reads the grant with InspectBuildGrant. A Machine that refuses the verb fails the build with a sentence that names ployz.build.grant.inspect.v1. A grant the Machine no longer holds reads as nothing pushed.
• Cancelling a Deployment fails its GitHub builds and cancels their runs. It no longer ends their grants, which expire on their own after 3 h.
• Cloud skips starting a GitHub build when a Server's record lists capabilities without ployz.build.grant.inspect.v1, and says "GitHub builds need a newer Ployz on ". A Server that lists no capabilities is attempted.
• docs/user/troubleshooting/builds.md lists the new skip and says to upgrade Ployz on that server.
• daemon-compat.ts gains pruneImages and buildGrantInspect, and serversLacking().
• core/DESIGN.md appends RemoveImages and EndBuildGrant to the removed-verbs paragraph.

Who notices

Servers on the current release until they upgrade. Their GitHub builds fail at the finish step, after the runner has built and pushed. Their automatic image cleanup reports Unsupported, and old images stay on disk until the upgrade.

Draft until the top of the stack is verified end to end.