test: fix stale malformed-label e2e test, split by failure site

[tgockel]

Since repo builds started re-merging inherited labels into the cache tag (stamp_repo_image_labels), a malformed org.outrig.mcp label hard-errors during ensure_image itself, so the old malformed_mcp_label_is_hard_error test panicked in its fixture helper before reaching the runtime-read assertion. The build-time failure is the better behavior; the test now asserts it directly.

The runtime-read path is still reachable: the ImageSourceRef::Image branch only probes/pulls and never re-validates labels, so a raw (non-built) image ref with a malformed label passes ensure_image and fails only at embedded::merged_mcp. A new e2e case covers it, building the raw fixture with image::build_standalone (which stamps nothing beyond the Dockerfile's own labels) under a fixed tag rebuilt each run. merged_mcp reads labels off the handle's image tag without exec'ing, so the test uses Container::attach instead of a full start/bootstrap/stop cycle, and both malformed-label fixtures are bare alpine + LABEL -- no node toolchain, no shadow.

Also dedupes the Build-source ImageConfig literal behind a shared fallible try_ensure_built_image helper and adds a non-e2e unit test pinning the hard-error site (merged_mcp_config_to_labels rejects a malformed inherited label) in plain cargo test.

Summary

What does this change, and why?

Checklist

• cargo fmt --all -- --check passes
• cargo clippy --workspace --all-targets -- -D warnings is clean
• cargo test --workspace passes
• Docs in doc/ updated if behavior changed (mdbook build still clean)
• CHANGELOG updated for user-visible changes

Notes for reviewers

Anything worth calling out -- tricky bits, follow-ups, or intentionally out-of-scope items.