fix(cli): use GHCR images for preset agent-images in chroot mode (#459)

* fix(cli): use GHCR images for preset agent-images in chroot mode

When using --enable-chroot with --agent-image act (or default), AWF
now correctly uses the pre-built GHCR images instead of always trying
to build locally from Dockerfile.minimal.

This fixes a bug where the packaged AWF binary would fail with:
"unable to prepare context: path '/snapshot/gh-aw-firewall/containers/agent' not found"

The issue was that chroot mode logic was checked before GHCR preset
logic, causing it to always attempt local builds even for preset images.

Changes:
- Prioritize GHCR preset images over local builds (even in chroot mode)
- Only build locally when: --build-local is set, OR --enable-chroot with
  a custom (non-preset) image
- Add tests for chroot + preset image combinations

Fixes #458

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(smoke-chroot): add -E flag to sudo awf for PATH preservation

Without -E flag, sudo does not preserve environment variables,
causing AWF_HOST_PATH to be set from sudo's default PATH instead
of the user's PATH with toolcache directories. This resulted in
Python/Node version mismatches between host and chroot.

The -E flag ensures PATH is passed to AWF, allowing proper
resolution of host toolcache binaries in chroot mode.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Author: Mossaka