fix: --dry-run must not pull images or rewrite the resolved tag

check_image ran unconditionally, so a dry run pulled a multi-GB image and,
when the requested tag was missing, its availability fallback rewrote
DEVA_DOCKER_TAG -- making --dry-run report a tag the user never asked for.

CI caught it as a precedence-test failure that could not reproduce locally:
:rust is pullable, so an earlier case pulled it, and the following
`-p cloak` case then failed to pull :cloak (not published yet), found the
freshly-pulled rust locally, and "resolved" to rust. The assertion was
right; the dry run was lying.

Resolution is what --dry-run reports; availability is a launch-time
concern. Skipping check_image on dry runs also makes the precedence
contract testable without any registry state -- the suite now passes with
docker entirely absent.

Refs #456

Author: lroolle

deva.sh

@@ -3958,7 +3958,11 @@ if dangerous_directory; then
 fi
 
 resolve_profile
-check_image
+# A dry run reports what would happen: it must not pull a multi-GB image, and
+# it must not let check_image's availability fallback rewrite DEVA_DOCKER_TAG,
+# which would report a tag the user did not ask for. Resolution is what --dry-run
+# is for; availability is a launch-time concern.
+[ "$DRY_RUN" = true ] || check_image
 prepare_base_docker_args
 dedup_user_volumes
 append_user_volumes