fix(sandbox): check configured shell image during preflight

[akemmanuel]

Summary

Refs #152. This is a small, independently reviewable preflight fix, not completion of the image-lifecycle incident.

• Inspect OPENGUI_SHELL_IMAGE in the selected Docker daemon when it is configured; fail preflight on a missing image, Docker failure, or invalid inspection result.
• Keep broker-free deployments compatible: no image setting means no image inspection.
• Never pull, prune, create containers, or change daemon configuration during inspection.
• Stop presenting successful daemon/file checks as proof of usable shell execution; document the same-broker-daemon requirement and actual authenticated restricted-grant probe.
• Do not expose image references, broker tokens, or image-inspection stderr in image findings.

Reproduction and tests

Before the fix, a healthy daemon/files fixture with shellImageAvailable: false incorrectly returned no findings. The added regression failed with expected [] to include 'OPENGUI_SHELL_IMAGE is not available …' and passes after the fix.

• vp test scripts/sandbox-doctor.test.ts scripts/sandbox-shell-broker.test.ts scripts/sandbox-host.test.ts --maxWorkers=2 — pass.
• vp check — pass.
• git diff --check — pass.

Docker is injected in tests: present/missing images, daemon failure, malformed inspection output, no pulling, broker-free compatibility, and diagnostic privacy are exercised without modifying a Docker daemon.

Explicit remaining work

#152 remains open. This does not install retention/keepers, locked cleanup, recurring real execution probes, external alerting, image distribution/restoration, or upgrade/rollback orchestration. A production revision/configuration audit and scoped disposable Docker lifecycle tests still need separate approval/evidence. No production deployment or pruning was performed.