Resolve and inherit metadata from first-class images

First-class image deployments currently carry the image reference forward without resolving or reading its OCI config. The direct-image branch leaves BuildResult empty, so version configuration applies source-build defaults instead.

This causes two known regressions:

• The image’s WorkingDir is replaced with /app.
• The image’s ExposedPorts never reaches the logic added by MIR-1445, so web services still initially default to port 3000.

Resolve the selected manifest and read its image config as part of the direct-image path. Persist and launch the same digest-backed image reference whose metadata was inspected, so a mutable tag cannot produce different configuration and runtime images.

Behavior:

• Inherit the image’s WorkingDir. If the image declares none, use the OCI default /. Keep /app as the default for source builds.
• When the service has no explicit port and the image exposes exactly one TCP port, use it according to the rules from MIR-1445.
• An explicit service port continues to win.
• Multiple exposed ports continue to require an explicit choice.
• Preserve the existing image ENTRYPOINT + CMD behavior.
• Store the configured source reference separately from the resolved runtime image so MIR-1446 can show provenance accurately.

Add regression coverage using direct images with a non-/app working directory and a single exposed TCP port. Verify that the process starts in the inherited directory, $PORT matches the exposed port, and the sandbox launches the resolved manifest.

This extends MIR-1445 and restores the behavior fixed for Dockerfile builds in MIR-715 along the first-class image path introduced by MIR-1452.