feat(toolchain): build-essentials in the agent runtime for target interpreters

The agent runner stage had build-essential only in the builder. When toolchain
matching is on, uv provisions the workspace against the target project's Python
and must compile an sdist for any dependency lacking a wheel for that version —
so build-essential now stays at runtime. The runner already permits uv managed
python downloads (only the builder pins UV_PYTHON_PREFERENCE=only-system, for
RoboCo's own 3.13 venv). Verified locally: in the built image,
`uv venv --python 3.14 && uv run python` prints Python 3.14.6 while the system
interpreter stays 3.13.

docker/agent-base.Dockerfile

@@ -36,8 +36,13 @@ FROM python:3.13-slim-bookworm AS runner
 
 # Runtime deps: Node.js 22 for claude CLI, git for workspace ops, jq for hooks.
 # gnupg is only needed to add the NodeSource repo, purged after install.
+# build-essential stays at runtime (NOT purged): when toolchain matching is on,
+# uv provisions the agent's workspace against the TARGET project's Python and
+# must be able to compile an sdist for any dependency that ships no wheel for
+# that interpreter version. Without a compiler the install fails and the agent
+# can't run the target's suite.
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl ca-certificates git gnupg jq \
+    curl ca-certificates git gnupg jq build-essential \
     && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
     && apt-get install -y --no-install-recommends nodejs \
     && npm install -g @anthropic-ai/claude-code \