Stop tagging the runner image :latest

[JonJagger]

:latest earned its keep when remove_old_images ran before the build: the
removal kept that one tag and nothing else, so it was what held the previous
image alive. Now that removal runs after the build, the keep-list also carries
this commit's tag, and that tag names the image just built. :latest points at
the same image, so it protects nothing the sha tag was not already protecting.

Neither reason given for keeping it holds. There is no cache-from anywhere in
the repo, and BuildKit's layer cache is not keyed by a tag, so :latest does
nothing for the build cache. Nor does local tooling reach it: creator, web,
dashboard, nginx and commander all name the runner
${CYBER_DOJO_RUNNER_IMAGE}:${CYBER_DOJO_RUNNER_TAG}, and versioner supplies a
pinned sha for that tag rather than latest. CI never refers to it either, and
check_args rejects 'server' inside CI, so this path does not run there.

cyberdojo/runner:<sha> stays. Sibling repos carry the dockerhub name in their
env-vars, not the ECR one, so a locally built runner still has to answer to it.

The dropped clause was already dead for the client image, which compose only
ever tags with the sha.

docs/profiling/time_docker_run_phases.sh names the tag in its help text and now
shows how the tag is derived. docs/multiple container properties-tests-failing
.txt still says :latest, and is left alone: it transcribes a debugging session
that was run against that tag, and rewriting the command would misreport what
produced the output below it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>