BYO agents: `bbox run-image` ephemeral one-shot run

[JAORMX]

Follow-up to #191 (epic), UX Tier 1. Lets a user experiment with any image once, without editing config or registering an agent.

Scope

bbox run-image ghcr.io/me/aider-bbox:latest -- aider --model gpt-5

bbox run-image ghcr.io/me/aider-bbox:latest \
  --name aider --env OPENAI_API_KEY --env 'AIDER_*' \
  --memory 4g --cpus 4 --mcp --mcp-authz-profile safe-tools \
  --egress-profile standard --allow-host api.openai.com:443 -- aider

This mode is explicitly ephemeral:

• no credential persistence by default
• no settings import by default
• no custom config-file injection unless requested
• no env forwarding unless explicitly requested

Notes / constraints

• Builds an in-memory agent.Agent from flags via the existing config.AgentFromOverride path (Add declarative bring-your-own agent support (#191 Phase 1) #200) and runs it through the normal SandboxRunner — no config-file mutation, no registry persistence.
• Snapshot isolation, review, egress/MCP tighten-only semantics all still apply.
• Universal BBOX_* env vars (Add declarative bring-your-own agent support (#191 Phase 1) #200) are injected as for any agent.
• Define the minimum image contract for an arbitrary image (boot/init compatibility, sandbox user/home, shell, command on PATH) — coordinate with the OCI-manifest follow-up (Phase 5).

Acceptance criteria

bbox run-image IMAGE -- CMD boots the image, runs the command, forwards only explicitly requested env, and persists nothing.