Build commander directly on the dind image, not on docker-base

[JonJagger]

docker-base exists to add ruby and a bundle of gems to docker:dind, and
commander is its last consumer. Commander needs none of the gems: it requires
only json, tempfile and date, all of which Alpine's ruby package carries, and
its tests are shunit2 shell rather than minitest. So the fold drops the Gemfile
and the bundle install entirely and adds two packages. The base already
supplies docker, its compose and buildx plugins, git and tar; bash and ruby are
what it lacks and what commander needs.

The platform is now pinned. docker-base published a single-arch amd64 image,
which made commander's build implicitly amd64; the dind base is multi-arch, so
without the pin an arm64 host selects an arm64 base and the x86_64 glibc apk
refuses to install. The pin states what was previously only implied, and
matches the amd64-on-arm64 warning the tests already filter.

Two test files move off images from 2019 and 2021. Their [cyber-dojo update]
regression tests reach back to commander images that read only
.ContainerConfig.Labels, which docker no longer returns from [docker inspect],
so those images cannot run on a current daemon at all. 0.1.329 is the oldest
release whose commander also reads .Config.Labels, and the pins move there.
This is independent of the base image: the same tests fail identically with the
Dockerfile untouched, and they still pass on CI, whose daemon is older. Ranking
by the versioner image's creation date is what makes 0.1.329 findable, since
development tags carry no version order.

[cyber-dojo update] now refuses a version older than that rather than
succeeding and leaving the next [cyber-dojo up] to die on a JSON::ParserError.
The check has to live in update: it runs in the currently-installed commander,
before the retag that switches versioner:latest, whereas up runs in the
just-installed old image where nothing we write can reach. It ranks by the
pulled versioner's creation date, so it costs no extra download, and an
unreadable date lets the update through rather than blocking an upgrade.
It cannot help anyone already on an old version; [cyber-dojo update latest]
remains their way out, and still works because update never inspects labels.

One assertion in test_065 stops pinning the daemon's exact wording for an
unknown tag. Daemons differ there, some saying "manifest for X not found" and
others 'failed to resolve reference "X": X: not found'. It now asserts the
parts both carry, so it holds on either.

run.sh takes an optional argument naming which test files to run, reached as
[make test_image tids=065]. No argument runs them all, as before.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>