Remove the git clone container's anonymous volume with it (closes #215)

The pinned alpine/git image declares a volume at /git, so Docker gives
every clone container an anonymous volume. The container was removed
without its volumes, leaving one volume behind per deploy. The removal
now also removes the container's anonymous volumes, on success and on
failure. A test runs a clone against a fake Docker API and checks the
removal asks for volumes to be removed.

Model: opus-5-5

TODO.md

@@ -20,6 +20,9 @@ regress.
 
 # Completed Steps
 
+- 2026-09-23: The git clone container is now removed together with its anonymous
+  volume (the `alpine/git` image declares one at `/git`), so a deploy no longer
+  leaves a Docker volume behind (#215).
 - 2026-09-23: Fixed the flaky `t.TempDir` cleanup race in `internal/handlers`
   (the one fixed in `internal/service/webhook` by #198):
   `TestHandleWebhookProcessesValidWebhook` now waits with the webhook service's