Add explicit BuildKit state volume cleanup lane

[shiny-code-bot]

Summary

• add a separate remove_buildkit_state_volumes runner-host hygiene action
• require explicit target volume names, matching policy allowlist, BuildKit state-volume naming, and zero container links from pre-apply evidence
• wire the GitHub workflow and executor to run named docker volume rm under the existing host lock, while keeping bounded cache prune unchanged
• document that this is not generic docker volume prune

Validation

• uv run python -m unittest tests.test_runner_host_hygiene tests.test_runner_host_hygiene_executor
• uv run python -m unittest tests.test_runner_host_hygiene tests.test_runner_host_hygiene_executor tests.test_filesystem_store tests.test_postgres_store tests.test_service
• uv run --extra dev mypy control_plane tests
• uv run --extra dev ruff check control_plane/contracts/runner_host_hygiene.py control_plane/cli_runner_lanes.py control_plane/workflows/runner_host_hygiene_executor.py tests/test_runner_host_hygiene.py tests/test_runner_host_hygiene_executor.py
• uv run --extra dev ruff format --check control_plane/contracts/runner_host_hygiene.py control_plane/cli_runner_lanes.py control_plane/workflows/runner_host_hygiene_executor.py tests/test_runner_host_hygiene.py tests/test_runner_host_hygiene_executor.py
• actionlint -config-file .github/actionlint.yaml .github/workflows/runner-host-hygiene.yml
• git diff --check

JetBrains changed-file closeout was run; it reports only PyCharm interpreter package-resolution noise for uv-managed deps, with no code findings after fixing weak warnings.