Get BuildKit off the release candidate and align daemon/client/test versions

We run three different BuildKit versions, and prod is on a release candidate:

• Daemon (prod): imagerefs.BuildKit pins a custom build v0.19.0-rc3-1-gfbd602b3d.m — a release candidate plus one local commit, built from ghcr.io/mirendev/buildkit and pinned by digest.
• Client lib: go.mod is moby/buildkit v0.19.0.
• Dev/test: .iso/Dockerfile pulls v0.17.1.

So CI tests against 0.17.1, ships rc3 to prod, and links the client at 0.19.0. Worth getting onto a single, current, stable release.

Work

• Rebuild the mirendev/buildkit image at a current stable release (figure out what the local "+1 commit" patch is and whether it's still needed), bump the imagerefs.BuildKit digest.
• Bump go.mod moby/buildkit to match.
• Align .iso/Dockerfile to the same release so we test what we ship.
• Validate daemon behavior across the jump (snapshotter, config schema, control API).

Note

This does not affect MIR-1280 — the GC prune logic is byte-identical from v0.19 through v0.31, so this is pure hygiene / de-risking the rc, not a fix. Surfaced while working MIR-1280.