fix(containerise): resolve devcontainer cache misses and add state-aware prune mode

[Copilot]

Container builds were suffering from full cache invalidation due to base image drift against VS Code's defaults, and the CLI lacked a safe way to execute global prunes while preserving excluded project states.

Cache Preservation

• Align image pull behavior: Injected --pull=true into the podman build array. VS Code DevContainers pulls base images by default; failing to do so in the CLI caused layer digest mismatches when upstream images (e.g. ubuntu:24.04) were updated, invalidating the entire 33-layer build cache.
• Enforce NESTED bypass: Wrapped the orphaned VS Code UID-wrapper pruning logic in a [[ "$NESTED" != "true" ]] check, fixing an omission in commit 4884d66.

State-Aware Global Pruning

• Programmatic Prune API: Wired up --prune, -a|--all, and --images flags to route to a new run_prune_mode.
• Graceful execution: Shielding --excluded projects during a destructive podman system prune -a --volumes is difficult since it doesn't accept exclusion flags. We sidestep this by temporarily starting the excluded containers prior to the prune, relying on the daemon's native active-state protection, then immediately halting them.

# Graceful state awareness: start kept containers to protect them and their images from global prunelocal -a started_for_protection=()
forcontainer_idin"${kept_container_ids[@]}";doif [[ $(docker inspect "$container_id" --format='{{.State.Running}}')!="true" ]];then
docker start "$container_id">/dev/null 2>&1&& started_for_protection+=("$container_id")
fidone
podman system prune -a --volumes -f
forcontainer_idin"${started_for_protection[@]}";do
docker stop "$container_id">/dev/null 2>&1done