fix: move Docker image pre-pull to sandbox startup (image build lacks mount privs)

The pre-pull of base images (node:22-alpine, python:3.12-alpine) cannot
run during Modal image build because the builder lacks mount privileges
for tmpfs. Move it to sandbox startup where dockerd runs as root with
full capabilities and the tmpfs-backed overlay2 storage works correctly.

Author: manascb1344

app.py

@@ -219,17 +219,10 @@ def _get_gpu_config(gpu_key: str):
         "update-alternatives --set iptables /usr/sbin/iptables-legacy",
         "update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy",
     )
-    # Layer 1b: Pre-pull common base images using Modal's optimized image system
-    # This avoids 140s+ Docker pulls through gVisor's slow netstack at runtime.
+    # Layer 1b: Include start-dockerd.sh for runtime pre-pull (moved earlier
+    # into a stable layer so it's cached alongside Docker setup).
     .add_local_file(_TEMP_DOCKERD_PATH, "/start-dockerd.sh", copy=True)
     .run_commands("chmod +x /start-dockerd.sh")
-    .run_commands(
-        "bash /start-dockerd.sh & sleep 5 && until docker info >/dev/null 2>&1; do sleep 1; done",
-        "docker pull node:22-alpine",
-        "docker pull python:3.12-alpine",
-        "docker pull alpine:3.19",
-        "kill %1 2>/dev/null || true",
-    )
     # Layer 2: Python deps (semi-stable)
     .apt_install("python3", "python3-pip", "python-is-python3")
     .pip_install("fastapi==0.115.0", "httpx==0.27.0")
@@ -744,6 +737,8 @@ async def github_webhook(request: Request):
             "bash -c '/start-dockerd.sh &'"
             " && sleep 5"
             " && until docker info > /dev/null 2>&1; do sleep 1; done"
+            " && docker pull node:22-alpine"
+            " && docker pull python:3.12-alpine"
             " && cd /actions-runner"
             " && export RUNNER_ALLOW_RUNASROOT=1"
             " && export DOCKER_BUILDKIT=1"