Run the image's entrypoint when no command is set (exec form)

Sub-issue of MIR-1430 (RFD-91). The core change, and the riskiest piece.

Today every service runs as /bin/sh -c "COMMAND", and the image's ENTRYPOINT is loaded then overridden. When no command is set, run the image's real ENTRYPOINT + CMD in exec form (argv, no shell), the way docker run IMAGE would.

Behavior:

• No command → process argv is the image's ENTRYPOINT + CMD in exec form. The seam is in controllers/sandbox/sandbox.go (oci.WithProcessArgs("/bin/sh", "-c", cmd) vs letting oci.WithImageConfig's argv stand).
• Command given → /bin/sh -c "COMMAND", unchanged.
• Service resolution: an image-backed service with no command should still yield a web service (today a custom Dockerfile needs an explicit service command).
• Drop the lossy buildImageCommand flatten path (servers/build/build.go) where it no longer applies.

Spike first: validate PID 1 and signal forwarding for the exec-form path (RFD-91's load-bearing open question) before the real change.

Own PR + tests; this changes how containers launch. Ref: RFD-91, "Command resolution".