Add integration test coverage for the moby v29 migration

What does this MR do?

Adds targeted, real-daemon integration test coverage for the parts of the moby v29 SDK migration (!6902 (merged)) that are structurally new or were previously only covered by mocked unit tests:

• Real TLS handshake against the dind service (TestDockerTLSConnection), plus a fast unit test confirming client construction fails closed when TLS certs are missing/invalid (TestTLSFailsClosedOnMissingCerts). The custom transport/TLS setup in helpers/docker/options.go was rebuilt from scratch for v29 but had zero real-TLS-handshake coverage end to end -- CI's dind connects over a local unix socket only.
• DNS override integration test (TestDockerCommand_DNSConfig).
• A new fixture image (tests/dockerfiles/many-exposed-ports) with 25 EXPOSEd tcp ports, and TestDockerServiceManyExposedPorts, which validates that the v29 SDK's network.PortSet/Port.Num() type parses real daemon data correctly for services exposing more than the runner's 20-port healthcheck cap.
• TestDockerCommandPullRetriesTransientRegistryFailure, a real end-to-end exercise of the new image-pull retry logic: points a build at a registry port nothing is listening on yet (genuine connection refused, classified as a retryable RunnerExternalDependencyFailure), then starts a real registry:2 container on that port via the same docker daemon partway through the retry backoff window, and asserts the build succeeds once it comes up. This is the one test here with real timing sensitivity, so it's gated behind a network_faults build tag and runs in its own integration test (docker, network-faults) CI job with allow_failure: true, so it can't destabilize the main integration suite.

While validating these locally I also found and fixed a genuine pre-existing bug on the target branch: TestDockerCommandWithPlatform asserts on info.Architecture, which comes back empty on Docker 29+ with the containerd image store (confirmed against a real Docker 29.1.3 daemon) -- the real value is only available via info.Descriptor.Platform.Architecture in that case. See the standalone commit fixing this.

Why was this MR needed?

Docker is an essential component of the runner and this is a large migration (~2000 lines, 20 files). Before it merges, we want real-daemon confidence in the areas that are new or only mock-tested, rather than relying solely on the existing mocked unit tests.

What's the best way to test this MR?

Each new test was run locally against a real Docker daemon (including a locally-run docker:27-dind with real generated certs for the TLS test, and a real local registry:2 for the retry test) before being committed -- see individual commit messages for details.