Support `image` as a first-class build source (no Dockerfile needed)

Sub-issue of MIR-1430 (RFD-91). The step that deletes the wrapper Dockerfile entirely.

Today image = "..." on a service is only a per-service image override at launch (svc.Image, controllers/deployment/launcher.go): it swaps which image runs for a service on an app that still builds something from source. It isn't a standalone source. Deploy an app whose only content is [services.web] image = "..." with no Dockerfile and the build fails at stack detection — detectBuildStack → stackbuild.DetectStack (servers/build/build_saga.go) returns "no supported stack detected," because nothing checks "this service already has an image, there's nothing to build."

Behavior:

• When a service sets image and the app has no buildable source, skip the build/stack-detection phase and use the referenced image directly (pull, don't build).
• The pulled image's ENTRYPOINT+CMD run in exec form (MIR-1444) and its EXPOSE supplies the port (MIR-1445).
• An app whose only source is image = "..." deploys with no Dockerfile and no .miren build config.

This is the last line of the Chatto/Hermes recipe shim: once it lands, a bare FROM upstream has no reason to exist and the recipe collapses to naming the image. Lineage: MIR-929 (canceled, revived here in spirit), RFD-91 happy path. Pairs with MIR-1444 and MIR-1445.