ImageBuild was called without setting ImageBuildOptions.Version, so
dockerd routed every build through its classic builder. Classic
synthesizes one intermediate container per Dockerfile step and
routes every container API through the daemon's authorization
pipeline. Behind an authz plugin (DAP's dap-authz, any equivalent
on consumer hosts) the per-step round-trip storm turns a sub-second
build into a multi-minute one — observed ~140× slowdown on a 7-step
Dockerfile against a 7.7GB base. BuildKit uses a single streaming
session and is unaffected.

Set Version: build.BuilderBuildKit. The moby /build endpoint accepts
a tar request body in BuildKit mode (verified empirically), so no
session / filesync wiring is required for our usage. Per-step
progress events are dropped under BuildKit because the aux trace
records are protobuf-encoded and decoding them would require pulling
in github.com/moby/buildkit; BuildStart / BuildCompleted still fire
and errors still propagate.

Also fix a long-standing bug in tarDirectory: symlinks were emitted
as TypeSymlink with an empty Linkname (the call to
tar.FileInfoHeader passed "" instead of os.Readlink(path)). Some tar
readers reject those as malformed and abort the build mid-stream —
common in compose-primary contexts containing node_modules/.bin/* or
similar bin-symlinks. Now readlink the target and pass it through.

Drop the `# syntax=docker/dockerfile:1.4` directive from the
features Dockerfile: classic ignored it, but BuildKit treats it as a
hard frontend-pull requirement that needs a session for credential
forwarding (which we don't open) and hangs behind broken registry
mirrors. The emitted Dockerfile uses no 1.4-only syntax. Same
directive in useruid.go is addressed in PR fix/uid-reconcile-syntax-directive.

Integration coverage: test/integration/build_context_symlink_test.go
builds a workspace whose context contains an unreferenced symlink
and asserts the build completes — regression guard for the tar
encoding bug.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

BuildKit refuses remote image-metadata resolution without an active
session ("no active sessions"), even for fully anonymous public-image
pulls — the session is the mandatory callback channel for registry
credentials. The previous commit set Version: BuilderBuildKit and
worked locally only because images were already in dockerd's local
store; CI (cold cache) hit the session error.

Side-step the session entirely by pre-pulling each FROM image via
the classic ImagePull API (which doesn't require a session). Once
the image is in the local store, BuildKit picks up the cached
manifest and skips remote resolution.

Implementation:
  - extractBaseImages does a naive Dockerfile parse: literal FROMs,
    $VAR / ${VAR} substitution against ARG defaults and BuildSpec
    Args, --platform=... and AS <stage> stripping, stage-name
    detection to avoid pulling intermediate stages.
  - prePullBaseImages calls ImageInspect first (skip if local) then
    PullImage best-effort (silently ignore errors so locally-built
    images like dc-go-base-* / dc-go-final-* don't fail when there's
    no remote to pull from; if the image really can't be obtained,
    the subsequent ImageBuild surfaces a clearer error).

Avoids pulling in github.com/moby/buildkit as a direct dep (~100+
transitive packages). The parser is intentionally minimal and drops
FROMs with unresolved vars rather than guessing — a missed pre-pull
just falls back to BuildKit's native error path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>