Isolate CI Buildx state for runner lane expansion

[cbusillo]

Summary

• isolate the CI container scan Buildx builder per run/attempt instead of using the shared launchplane-ci builder
• tag the loaded scan image per run/attempt and remove it in an always() cleanup step
• document the shared-host precondition that Buildx builders and loaded image tags must not be shared mutable names before increasing general lane count

Investigation context

The slow Merge Train run was queued on the self-hosted chris-testing label pool, not blocked by host CPU or memory. The host has ample headroom, but only two normal Launchplane lanes carry the broad chris-testing label. Agents including Antigravity/Gemini-family agreed this is a lane/label contention problem. Before adding a third normal lane, this patch removes the CI Docker name collisions that would be exposed by more same-host concurrency.

No host mutation or ad hoc runner registration is included. Runner creation remains gated on the documented supervised maintainer path.

Validation

• actionlint .github/workflows/ci.yml
• npx --yes markdownlint-cli2 docs/runner-lane-baseline.md
• git diff --check