Validate RuntimeConfig fields at all entry points

[JAORMX]

Summary

• RuntimeConfig values (AdditionalPackages and BuilderImage) are interpolated into Dockerfile templates via text/template. To harden these inputs, add strict validation at all entry points before values reach template rendering.
• Add a Validate() method on RuntimeConfig that enforces a strict allowlist regex for package names and uses go-containerregistry/pkg/name.ParseReference() for builder image references. Call it at every path where RuntimeConfig is accepted: CLI flags, API requests, config file storage, and the runner's runtime config loader.

Type of change

• New feature

Test plan

• Unit tests (task test)
• Linting (task lint-fix)

Changes

File	Change
pkg/container/templates/runtime_config.go	Add Validate() method with package name regex and image ref validation
pkg/container/templates/runtime_config_test.go	Add 8 test functions covering valid/invalid packages, images, empty configs, multiple errors, defaults
cmd/thv/app/run_flags.go	Call Validate() in configureRuntimeOptions() and handleImageRetrieval()
pkg/runner/protocol.go	Call Validate() in loadRuntimeConfig() before returning overrides
pkg/config/config.go	Call Validate() in setRuntimeConfig() before persisting

Does this introduce a user-facing change?

Users will now get a clear error message if they pass an invalid package name (e.g., containing shell metacharacters) via --runtime-add-package or an invalid image reference via --runtime-image. Previously these would be silently passed through to the Dockerfile template.

Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 58.82353% with 14 lines in your changes missing coverage. Please review.
✅ Project coverage is 69.01%. Comparing base (85df88f) to head (34a0aa9).
⚠️ Report is 4 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/runner/protocol.go	9.09%	7 Missing and 3 partials ⚠️
pkg/config/config.go	0.00%	3 Missing ⚠️
pkg/container/templates/runtime_config.go	95.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4196      +/-   ##
==========================================
- Coverage   69.13%   69.01%   -0.13%     
==========================================
  Files         467      468       +1     
  Lines       46996    47047      +51     
==========================================
- Hits        32492    32470      -22     
- Misses      11959    11995      +36     
- Partials     2545     2582      +37     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.