fix(runtime): pin docker image builder release

[117503445]

Summary

• Pin the default docker-image-builder download to v0.0.0-20260518-164317-160dd89efac1 instead of latest.
• Verify the pinned release with embedded SHA256 digests for supported platform artifacts.
• Keep DOCKER_IMAGE_BUILDER_BINTAG override support, still requiring a sibling .sha256 file for overridden tags.
• Update runtime docs and unit coverage for pinned/default and custom-tag paths.

Validation

• make lint
• make format-check
• .venv/bin/mypy src/agentrun_cli
• make coverage
• Temporary HOME real download through ensure_builder_binary()

[Copilot]

Pull request overview

This PR updates the AgentRun CLI runtime cloud-build helper to pin the docker-image-builder download to a specific release tag and verify the pinned artifacts via embedded SHA256 digests, while still supporting a custom DOCKER_IMAGE_BUILDER_BINTAG override (verified via the tag’s sibling .sha256 file).

Changes:

• Pinned the default docker-image-builder release tag and added embedded SHA256 digests for supported artifacts.
• Routed checksum selection through a new helper that uses embedded digests for the pinned tag and remote .sha256 for custom tags.
• Updated unit tests for pinned/default vs custom-tag behavior, and adjusted runtime docs (though the current doc diff removes important user-facing details that should be retained/updated).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
src/agentrun_cli/_utils/cloud_build.py	Pins builder tag, adds embedded SHA256 map, and selects expected digest based on pinned vs custom tag.
tests/unit/test_cloud_build.py	Updates tests to validate pinned-tag behavior uses embedded digests and custom tags still use remote .sha256.
docs/en/runtime.md	Removes the docker-image-builder download/verification and override documentation (should be updated to reflect new pinned + embedded SHA behavior).
docs/zh/runtime.md	Removes the docker-image-builder download/verification and override documentation (should be updated to reflect new pinned + embedded SHA behavior).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.