Preserve host-builder cache across the canonical just test gate

[ebursztein]

Problem

The canonical local just test builds capsem-host-builder in its Linux parity stages, then test-assets calls scripts/ensure-docker-space.sh 16. When daemon free space is below the threshold, that script runs docker builder prune -af.

In the July 18 physical-Mac Ironbank run, this deleted the layers for the identical host-builder image. Stage 7 immediately called just cross-compile arm64, rebuilt all 16 Dockerfile layers from scratch, and spent 255 seconds recreating the image before compiling either package. The gate therefore destroys a cache it knows a later required stage will consume.

The same audit found that ensure-docker-space.sh probes daemon space with docker run --rm debian:bookworm-slim without an explicit native --platform; check_container_clock() similarly runs an unqualified alpine tag. A cached foreign-architecture tag can therefore silently invoke QEMU/Rosetta in local or CI helper paths.

Required outcome

• The local Ironbank gate may reclaim enough Docker space for both asset lanes without deleting the exact host-builder cache required by later stages.
• Cache cleanup must be ownership-aware and fail closed if the required disk cushion cannot be achieved safely.
• Native helper containers must normalize x86_64/amd64 and arm64/aarch64 to an explicit Linux platform and reject unknown host architectures.
• Preserve the release rule: just test still executes every rail; this issue only removes self-inflicted rebuilds and foreign-architecture helper execution.

Acceptance criteria

• A contract test proves test-assets space recovery preserves the host-builder cache needed by Stage 7.
• A local full-gate trace proves Stage 7 reuses the image built earlier in the same just test invocation.
• Adversarial tests cover low-space cleanup, insufficient-space failure, both host-architecture alias pairs, unknown architecture, and a cached foreign image tag.
• ensure-docker-space.sh and container-clock diagnostics explicitly select the native platform.
• The release-process and dev-testing skills document the cache-ownership and explicit-platform contracts.