Fix hosted Docker worker provisioning

[mrubens]

Summary

• Pin local development provisioning to the immutable worker image for the current origin/develop commit while preserving environment-variable overrides.
• Bump the hosted worker runtime schema so E2B, Daytona, and Blaxel rebuild their provider artifacts.
• Validate Docker Compose during E2B template creation as root, then restore the roomote runtime user and workdir.
• Temporarily disable Dockerfile and Docker Compose environments on Modal and fail before provisioning with a clear provider-selection message.

Root cause

Mutable development image tags could leave hosted providers reusing stale images or already-provisioned artifacts. E2B template builds also did not reliably preserve the image user while validating Docker through sudo. Modal VM runtime remains unreliable for the worker bootstrap and is explicitly excluded for now rather than exposing a broken path.

Validation

• Targeted controller, types, and compute-provider Vitest suites.
• Package typechecks for controller, compute-providers, types, and dev.
• Package lint for controller, compute-providers, types, and dev.
• Pre-push lint:fast, check-types:fast, and knip.

[roomote-roomote]

No new issues in the latest change, and both earlier issues are now resolved. See task

• 🟡 apps/dev/src/index.ts:34-39 — Resolved: now resolves the full SHA with git rev-parse origin/develop and slices to exactly 8 chars, matching the publish workflow's develop-${GITHUB_SHA:0:8} tag.
• 🟢 packages/types/src/setup-compute-config.ts:735-739 — Resolved: buildSetupComputeStatus now derives hostedImageRef via resolveDerivedModalBaseImageRef, so the displayed hosted image matches the pinned :develop-<sha> used for provisioning.

_{Reviewed f43c9de}