feat(skills): show which sandbox images the host actually has

[squarezw]

Pairs with ragent-service#74, which adds present to GET /sandbox-images.

This half matters: without it the data exists and the screen does not change.
The dropdown still offers ragent-skill-fund:latest, and picking it still fails
only at run time — exit_code=125, with docker phrasing it as pull access denied.

A registered image is not an image that exists. The allow-list records what is
permitted, not what is on the host. Absent entries are now marked in the list,
and selecting one explains what will happen and why that permission-sounding
error is not about permissions — the image was built locally and pushed nowhere,
so it has to be rebuilt.

Marked, not disabled

Configuring an image before building it is a legitimate order of work, and
disabling would block it. The goal is to make "this will not run" visible before
the choice, not to make the choice.

Three states kept apart

null means docker is unreachable, so nothing can be judged. Marking every image
absent in that case would send someone off rebuilding all of them when the fix is
to mount the socket.

Parsing accepts only real booleans. "false", 0 and "" each invert the
backend's meaning under a truthiness check, and an older backend omits the field
entirely — which, read as false, would light a warning on every image at once.

Tests

251 passed, tsc unchanged at the 134 baseline. Mutation-verified: truthiness
coercion and treating a missing field as false each turn 3 red.

🤖 Generated with Claude Code