apply: ensure a scheduled container's image is present at apply, without running it

A schedule: container (ADR 0053) is installed as present state and never run at apply — the
Scheduler fires it later on its cadence. But a service or run-once container only gets its
image as a side effect of docker run, so a scheduled step's image was not pulled until its
first scheduled fire: absent from the node right after a successful apply, so the first run
paid the whole pull latency and tooling that expects the image present after apply found it
missing.

applyContainer now probes the runtime and ensures the pinned image present for a scheduled
step before recording it. A new ensureImage helper inspects the image and pulls it only if
absent, then reads back (ADR 0018). Ensuring an image is not running it: no docker run fires
the container, so the no-run invariant of ADR 0053 holds. The runtime probe, previously
skipped for a schedule, now runs because a pull needs it — the schedule.go comment is updated
to match.

Tests: the install-does-not-run test is extended to allow the image-ensure while asserting no
fire and no needless pull; a new test applies a scheduled container whose image is absent and
asserts it is pulled and still not started. go build, go vet, go test ./... all pass.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

internal/apply/schedule.go

@@ -203,8 +203,9 @@ func (s *Scheduler) fire(ctx context.Context, j *scheduledJob) {
 	s.log(fmt.Sprintf("scheduled step %s: run completed", j.id))
 }
 
-// runtime detects the container runtime once and caches it. A scheduled step does not need one to be
-// installed (see applySchedule), only to be fired, so detection is deferred to here.
+// runtime detects the container runtime once and caches it. The Scheduler needs one only to fire a
+// run, so detection is deferred to here — separate from the apply, which does its own probe when it
+// ensures a scheduled step's image is present (see applyContainer).
 func (s *Scheduler) runtime(ctx context.Context) (string, error) {
 	s.mu.Lock()
 	cached := s.cri