Preflight must verify compatible Docker Buildx image resolution

[vishr]

What happened

A fresh Ubuntu host can pass ob preflight and still be unable to plan or deploy
any workload image because Onebox does not check the Docker Buildx capability it
uses for image resolution.

This was reproduced while building the real-server lane in #44:

• Ubuntu's docker.io package does not include Buildx. Preflight reports the
  container runtime healthy, then planning fails when it reaches
  docker buildx imagetools inspect.
• Ubuntu's docker-buildx 0.30.1 accepts the --format invocation used by
  Onebox, ignores it, and exits 0 without returning the requested digest. Onebox
  then reports that registry inspection returned no valid digest, which points
  at the registry rather than the incompatible client.
• The identical command works with the current Docker Buildx plugin installed
  by the real-server harness.

The harness now installs Docker's packages explicitly, so the release gate is
green, but ordinary hosts can still hit the defect.

Why this is a bug

Resolved.Preflight checks only docker version. Planning later resolves every
tagged workload through docker buildx imagetools inspect --format '{{.Manifest.Digest}}'. A prerequisite that can block every deployment should
be diagnosed before planning and should not be reported as a registry failure.

Scope

• Add a read-only capability check for the exact Buildx behavior Onebox needs,
  not merely the presence of a docker buildx command.
• Distinguish a missing or incompatible Buildx client from registry
  authentication, reachability, rate-limit, and missing-image failures.
• Give an actionable remedy naming the Docker Buildx plugin/version requirement.
• Keep preflight non-mutating and avoid consuming registry quota merely to
  establish that the local client supports the required output contract.

Acceptance

• A host with no Buildx fails preflight with a Buildx-specific remedy.
• A Buildx version that accepts but ignores the required format is rejected or
  handled through a compatible fallback.
• A compatible Buildx installation passes.
• Image-resolution errors retain distinct diagnostics for client capability and
  registry failures.
• Tests cover missing, incompatible-success-with-invalid-output, and compatible
  clients.

Extracted from the verified host findings in #44 so the defect is independently
trackable.