fix(image): honor --pip in the on-instance Dockerfile-build path (calque#196)

[scttfrdmn]

Summary

• Found via a real calque real --script blending_app.py --function inspect_netcdf_bundle --pip xarray --pip netCDF4 run against real AWS: the Dockerfile built successfully, then the container run failed immediately with No module named 'xarray'.
• Root cause: --pip was consumed ONLY by bootstrap.go's HostMode branch. A picked unit whose resolved image needs an on-instance Dockerfile build (calque#177's NeedsBuild path — e.g. a real dependency installed via a git-cloned requirements.txt, which calque correctly can't statically resolve into a .pip_install(...) layer) silently dropped --pip entirely, with no leak, no warning.
• New image.Spec.PipPackages renders an extra RUN pip3 install --no-cache-dir <packages> layer, placed after the resolved chain's own steps (so it can supplement/override anything the chain's own pip_install already laid down) and before the worker-glue COPY lines. Threaded through realrun.go's NeedsBuild call site.
• The separate bare-pull path (calque#176, no Dockerfile built at all) now leaks loudly when --pip is supplied there too, since there's genuinely no Dockerfile layer to add it to in that case — better than the prior silent drop.

Files touched

• internal/image/dockerfile.go — Spec.PipPackages, extra layer rendering.
• internal/image/dockerfile_test.go — new tests (extra-layer placement, byte-for-byte-unchanged empty case).
• cmd/calque/realrun.go — threads o.pipPackages through the NeedsBuild call site; new leak on the bare-pull path.
• CHANGELOG.md.

Test plan

• go build ./... && go vet ./... && gofmt -l . && go test -count=1 ./... — all pass
• golangci-lint run ./... — 0 issues
• ruff check . — all checks passed
• New TestRenderPipPackagesAddsExtraLayer/TestRenderNoPipPackagesUnchanged, using a fixture (runCommandsOnlyImage) mirroring blending_app.py's real image-chain shape that triggered this live