feat: emit DockerBuildPlan when the CLI owns the build (#24)

[antoinetoussaint-byte]

Closes #24.

Summary

• This is a category 2 agent (issue triage): it renders its own Dockerfile and calls WithDockerImages in Builder.Build, rather than delegating to the shared rust.BuildRustDocker runner. So it needs a code change, not just a re-pin.
• Builder.Build now gates on services.BuildPlanRequested(req) (a non-empty BuildRequest.output_directory): when the CLI owns the build, it emits a DockerBuildPlan over the rendered recipe via s.Builder.SingleImageBuildResponse(req, image.FullName()) so the CLI runs docker buildx multi-arch (linux/amd64 + linux/arm64) and pushes a manifest list. The empty-output_directory case keeps the in-process build, so the change is backward compatible — an unmigrated CLI still gets a DockerBuildResult.
• The four-line gate mirrors the canonical shared runner (runners/rust/agent_builder.go in core v0.3.8) exactly, so this agent and the shared-runner agents converge on one recipe path.

Notes / risk

• Re-pins core v0.3.4 → v0.3.8. The recipe contract landed in v0.3.6 (core#332); the runners/helpers the migration uses (SingleImageBuildPlan, RecipeBuildPlatforms, SingleImageBuildResponse) landed in v0.3.8 (core#336). v0.3.6 shipped only the primitives, so v0.3.8 is the first release this migration can pin to.
• core v0.3.8 requires go 1.27.0, so the go directive is bumped accordingly (forced by go mod tidy). The release workflow runs GoReleaser in goreleaser-cross:v1.26.4 (Go 1.26.x); Go's default GOTOOLCHAIN=auto will fetch go1.27.0 at build time, but if the release image is network-restricted the pin may need bumping to a goreleaser-cross release that bundles Go 1.27. Flagging rather than changing release infra in this PR.

Test plan

• go build ./...
• go vet ./...
• go test ./... (all pass, including the new TestBuildEmitsRecipeWhenOutputDirectorySet, which asserts the plan carries a single Dockerfile/.-context recipe with the amd64+arm64 platforms and verifies against the emitted tree)
• Validation: a consumer with no codefly toolchain can docker buildx build --platform linux/amd64 -f services/<svc>/builder/Dockerfile services/<svc>

🤖 Generated with Claude Code