feat(dsl)!: ubuntu:24.04 default for imageless roots; drop default_image

[markovejnovic]

Problem

Imageless root steps fell back to `alpine:latest`, which has no `apt-get`. The SDK's toolchains (`hm.js.project`, `hm.python`, `hm.rust`, `hm.go`, …) all run `apt-get`, so a minimal pipeline died with `sh: apt-get: not found` (exit 127) unless the author remembered to pass `default_image=`.

$ hm run
  ✗ :node: apt-base  559ms  exit 127
sh: apt-get: not found

Change

Make `ubuntu:24.04` the across-the-board default, and remove the `default_image` footgun:

• DSL lowering now stamps `ubuntu:24.04` on every imageless root command step (Python + TypeScript). This bakes an explicit `image` into the emitted IR, so it's correct for both local `hm run` and cloud/webhook builds. Per-step `image=` still overrides; child steps stay imageless (they boot from the parent snapshot).
• Local executor bare fallback changed `alpine:latest` → `ubuntu:24.04` (defense-in-depth for hand-written/flat IR).
• `default_image` / `defaultImage` authoring parameter removed from both DSLs (`pipeline()`, `@hm.pipeline`, registry, envelope, TS `PipelineOptions`), all init templates, and docs.

Scope (deliberately retained)

The v0 wire field `default_image` and the Elixir backend's handling are kept as tolerated legacy input — the DSLs simply stop emitting it. Hand-written-JSON inheritance tests (`graph_build`, `graph_serde`, `default_image_inheritance`) are unchanged and still pass. Fully removing it from the wire contract is a follow-up, alongside generic `apt_get` support.

Verification

• Python: 487 passed, 1 skipped; ruff clean
• TypeScript: 377 passed; `tsc` clean
• Rust: `clippy --all-targets -D warnings` clean; all tests pass (e2e fixtures regenerated for both languages; Docker-backed integration tests are `#[ignore]`)

Also repaired pre-existing rot in two `#[ignore]`'d fixtures so they render again (`scratch().run()`→`.sh()`, variadic `pipeline(a,b)`→`pipeline([a,b])`).