Harden image admission, resource recovery and session renewal

Add exact-image compatibility policy, experimental admission, paginated build history and shared reauthentication checks. Preserve uncertain Docker creation records, bound frontend resource waits and renew runtime sessions proactively.

Lazy-load and split Monaco, add regression and opt-in live Docker fault tests, and record full race and real-browser acceptance results.

internal/api/images_delete.go

@@ -31,6 +31,8 @@ func (a *API) deleteImage(w http.ResponseWriter, r *http.Request) {
 	// entry before creating containers; the transaction below re-checks that
 	// journal, and an upgrade racing an administrator deletion fails safely
 	// with its own rollback path.
+	admissionMu.Lock()
+	defer admissionMu.Unlock()
 	buildQueue.Lock()
 	defer buildQueue.Unlock()
 	if buildQueue.active[a.s.DB] {