fix(dev-platform): make the local docker-compose deploy actually run a job

[Weegy]

Make the dev-platform local docker-compose deploy actually run a job

Epic #470 shipped the full dev-platform, but the local docker-compose.dev-platform.yaml overlay was never exercised end-to-end. Standing it up on a local omadia-dev stack surfaced three defects that each independently prevented a job from running. All three are fixed here and verified against a live local stack.

Fixes

1. Port mismatch. DEV_PLATFORM_RUNNER_BASE_URL and OMADIA_INTERNAL_API_URL pointed at middleware:3000, but the kernel listens on :8080. Repointed both.

2. daemon ↔ dind TLS altname mismatch. DOCKER_HOST was tcp://dev-dind:2376, but dind's auto-generated server cert carries no dev-dind altname, so --tlsverify failed the hostname check and the daemon could not reach the engine at all. The dev-engine network is now IP-pinned (subnet 172.28.6.0/24, dind 172.28.6.2, daemon 172.28.6.3) and DOCKER_HOST targets dind's pinned IP — which dind's boot-time cert regeneration always covers — so the connection stays valid across recreates. TLS verification stays ON (no --tls-without-verify shortcut).

3. Unconditional registry pull. The daemon docker pulled the runner image on every warm and every job. Locally the image is built + docker loaded straight into dind and the default-deny egress proxy answers a registry pull with 407 Proxy Authentication Required, so no container could ever be created. Added a gated DEV_RUNNER_PULL_POLICY:

   • always (default — the prod posture): re-pull on every provision, so the boot-time digest-pin + cosign vetting runs each time.
   • if-not-present: skip the re-pull only when the image is already cached in the engine.

   It changes only whether a present image is re-pulled — it does not touch the image allowlist or the digest requirement (both enforced in policyClient long before this runs), so a job naming an unlisted image is still refused whether or not it is cached. imageIsPresent does a purely local inspect (404 → pull; any other engine error propagates rather than being coerced to present/absent). The overlay sets if-not-present for local dev.

Isolation preserved

No isolation property is weakened: egress stays default-deny, middleware still has no docker socket / no DOCKER_HOST, daemon↔dind TLS verification stays on, and the image allowlist + digest enforcement are untouched. The pull-policy default (always) leaves the production posture exactly as shipped.

Verification

Rebuilt the daemon image and recreated the stack on the pinned network. Daemon log: connects to dind over TLS with no altname error, and warms the pre-loaded omadia-dev-runner:latest with no 407 (the repeating image warm failed line is gone). Daemon suite green: 384 tests (+5 covering the pull-policy skip-when-present path).

Local-dev prerequisite (unchanged posture)

With if-not-present, the runner image must be present in dind first (build it and docker load it into the dind engine) — inherent to local dev, since the image is not on an accessible registry. Production is unaffected: it keeps always + a real registry.