fix(containerise): resolve devcontainer cache misses and add state-aware prune mode

[Copilot]

Container builds were suffering from full cache invalidation due to base image drift against VS Code's defaults, and the CLI lacked a safe way to execute global prunes while preserving excluded project states.

Cache Preservation

• Align image pull behavior: Injected --pull=true into the podman build array. VS Code DevContainers pulls base images by default; failing to do so in the CLI caused layer digest mismatches when upstream images (e.g. ubuntu:24.04) were updated, invalidating the entire 33-layer build cache.
• Enforce NESTED bypass: Wrapped the orphaned VS Code UID-wrapper pruning logic in a [[ "$NESTED" != "true" ]] check, fixing an omission in commit 4884d66.

State-Aware Global Pruning

• Programmatic Prune API: Wired up --prune, -a|--all, and --images flags to route to a new run_prune_mode.
• Graceful execution: Shielding --excluded projects during a destructive podman system prune -a --volumes is difficult since it doesn't accept exclusion flags. We sidestep this by temporarily starting the excluded containers prior to the prune, relying on the daemon's native active-state protection, then immediately halting them.

# Graceful state awareness: start kept containers to protect them and their images from global prune
local -a started_for_protection=()
for container_id in "${kept_container_ids[@]}"; do
    if [[ $(docker inspect "$container_id" --format='{{.State.Running}}') != "true" ]]; then
        docker start "$container_id" >/dev/null 2>&1 && started_for_protection+=("$container_id")
    fi
done

podman system prune -a --volumes -f

for container_id in "${started_for_protection[@]}"; do
    docker stop "$container_id" >/dev/null 2>&1
done