Attach a BuildKit session to builds and demultiplex container logs (closes #251)

Builds now attach a BuildKit session over the Docker API, as the docker
command line does, and pass its ID with the build. BuildKit fetches a base
image that is not on the host through that session; without one, Docker
Engine 27 failed the build with "no active sessions". The session is
closed when the build ends.

Container logs are now read with stdcopy, so the clone output in the build
log and the app logs no longer carry Docker's 8-byte frame headers, and the
commit is read from the clone output; the header in front of the COMMIT
line kept it from being found.

Model: opus-5-5

TODO.md

@@ -20,6 +20,12 @@ regress.
 
 # Completed Steps
 
+- 2026-10-01: Builds attach a BuildKit session, as the docker command line does,
+  so a base image that is not on the host is pulled instead of the build failing
+  with "no active sessions" on Docker Engine 27. Container logs, and so the
+  clone output in the build log and the app logs, no longer carry Docker's
+  stream frame headers, and the commit is now read from the clone output (#251).
+
 - 2026-09-29: The app page is 50% wider on large screens (84rem instead of
   56rem), its build log and container log boxes are twice as tall, the build log
   sits between the webhook URL and the environment variables, and the container