ci: pin the smoke image with a running container during the test

The label only protects against reclaims that honour it. The runner
hosts also run jobs we do not control: runner-2 has a second act_runner
registered with gitea.egl.lan on the same Docker daemon, and
opencode-devbox's workflows run raw `docker system prune -af` in 7
places. No prune removes an image a running container uses, so the
smoke step now starts a holder (`ci-reclaim-docker.sh hold`: --rm,
--network none, sleep 3600) right after the preflight, and the
always() cleanup step runs `release` (holder + image). Unprotected now:
only the seconds between the build step's load and the holder starting.

Verified on an isolated docker:29-dind: an unlabelled held image survives
raw system prune and image prune -af (control without holder: deleted);
hold fails on a missing image; holder is AutoRemove + network none;
release removes holder and image; reclaim behaviour unchanged.

AGENTS.md

@@ -45,12 +45,15 @@ re-brand of opencode-devbox's `pi-only` variant.
   update-description). The `-studio` variant adds independent
   `smoke-studio` + `build-variant-studio` jobs that gate only the
   `-studio` tags (never the core `:latest` release).
-- `scripts/ci-reclaim-docker.sh` — the ONLY way a CI job frees disk. Jobs on
-  the same runner share its Docker daemon (runner-a1 runs several at once), so a bare `docker system prune -a` in one
+- `scripts/ci-reclaim-docker.sh` — the ONLY way a CI job frees disk. Everything
+  on one runner host shares its Docker daemon (runner-a1 runs several jobs at
+  once; runner-2 also hosts a runner for gitea.egl.lan), so a bare `docker system prune -a` in one
   job deletes the smoke image another job is mid-test on (v1.12.2 run 740 lost
   its `-studio` tags that way). The script spares images labelled
   `se.jordbo.pi-devbox.ci-smoke-image`; the smoke jobs apply that label,
-  assert it (`assert-protected`) and remove their own image at the end.
+  assert it (`assert-protected`), pin the image with a running container for
+  the test (`hold`, against raw prunes from jobs we do not control) and
+  `release` it at the end.
   `lint.yml` fails on any raw `docker system|image prune` in a workflow.
 
 ## Versioning scheme