Report the build's own error and refuse daemons too old for BuildKit (closes #234)

A build whose output ends in Docker's error line now fails with that
error, instead of going on to inspect a tag that was never created. The
build output is written to the deployment log before the failure is
recorded, so the log ends in order. Before building, upaas compares the
daemon's API version with 1.39 (Docker Engine 18.09), the first that
builds with BuildKit without experimental mode, and fails the deploy on
an older daemon instead of letting it use the legacy builder. The
README's Compose section gives the update command and the Docker Engine
versions builds need.
Disclosure: merged after a rebase that changed only TODO.md; the review gated this tree on the current next.

Model: opus-5-5
Co-authored-by: clawbot <sneak+clawbot@sneak.cloud>

TODO.md

@@ -20,6 +20,13 @@ regress.
 
 # Completed Steps
 
+- 2026-09-29: A failed build now fails the deploy with the build's own error
+  instead of a later "failed to inspect image", and the deployment log shows the
+  end of the build output before that error. upaas refuses to build on a Docker
+  Engine older than 18.09, which cannot build with BuildKit. The README's
+  Compose section says to update with `docker compose up -d --build` and names
+  the Docker Engine versions builds need (#234).
+
 - 2026-09-29: An image built from the `Dockerfile` now shows the commit it was
   built from (the `git describe` output) in the footer and `/health` instead of
   `dev`: `.dockerignore` no longer leaves out `.git`, nor any tracked file,