Never run the replays from the workspace, with or without a judge cache

Without a judge cache the replays still ran mesh-lab's checkout in the workspace
with the container runtime's socket, so a self-judging pull request could write
a test into them (hq issue 709, review 12303). They now run from a copy in a
container volume of the check's own, made before anything of the change runs,
with a fresh home and throwaway caches, removed after the check.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/mesh-builder/main.go

@@ -313,8 +313,9 @@ func answer(ctx context.Context, publisher builder.Publisher, on, workspace stri
 			registry = r.Address
 		}
 		spec := checkSpecOf(request)
-		// The judge cache the build agent declares as its own data, never in the workspace: only judge builds mount
-		// it, so no pull request's script can write what a judge is built with or kept as (novox/hq ADR 0358 §6).
+		// The judge cache the build agent declares as its own data, never in the workspace: only judge builds and
+		// mesh-lab's replays mount it, never a check's containers, so no pull request's script can write what a judge
+		// is built with or kept as, or what the replays run (novox/hq ADR 0358 §6, issue 709).
 		spec.JudgeCache = judgeCache()
 		// What the merge would move, built by the check for the walk to take (novox/hq ADR 0350 §1): into the
 		// scratch namespace. **Never with the package registry's credential**: this is code nobody has approved