refactor(dockerfile): drop all regexp; delete dead code; add missing build-context syntax directive

Follow-up to the BuildKit migration, addressing two smells:

1. No more regexp in internal/docker/dockerfile.go. FindBaseImage now expands the
   FROM line with BuildKit's shell lexer (against the preamble ARGs + --build-arg),
   deleting the regex-based resolution (replaceVariables/getExpressionValue/
   findValue + argExpression) — validated against all 13 findBaseImage oracle
   cases, quoted ${x:+}/${x:-} expressions included. EnsureFinalStageName detects
   the final stage name via BuildKit and injects " AS <name>" with hand tokenized
   parsing (no regex), keeping the tolerant fallback for trailing inline comments.

2. Dead code was a signal we were missing a behavior, not just dead code:
   - findUserStatement had no production caller because our build-then-extend
     architecture inspects the BUILT image's Config.User (which already reflects
     the Dockerfile USER) instead of statically scanning it as the single-build TS
     CLI must. Genuinely unnecessary here — deleted (with its oracle tests).
   - SupportsBuildContexts existed only to decide the feature Dockerfile's syntax
     directive, but nothing wired it in — so a feature build using --build-context
     never emitted `# syntax=docker/dockerfile:1.4`, and would fail on a Docker
     whose default frontend predates build contexts. Fixed GenerateExtendImageBuild
     to emit it when useBuildKitContexts (matching the TS), then deleted the now
     unused function + its oracle tests.

dockerfile.go 420 -> 274 lines, zero regexp. All remaining oracle + package tests
pass; new test covers the syntax-directive fix.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: aledbf