Fix remote build context identity and preserve hard-linked files

[Dingway98]

Summary

Changes

Validation

• ruff check
• pytest

---

Note

Medium Risk
Changes remote build context packaging and identity semantics (hard links, hashing); incorrect fingerprint behavior could cause false cache hits or unnecessary build failures, though extensive tests cover the contract.

Overview
Adds cacheable remote Dockerfile builds via a stable context fingerprint and a pre-upload consistency check.

Callers can compute docker_build_context_fingerprint from hyperbrowser.build_context (same Dockerfile/ignore/sparse-vs-full rules as packaging, without staging or compressing the tree) and pass it as expected_context_fingerprint on remote build_image_from_dockerfile. Packaging recomputes the fingerprint from the bytes actually archived; a mismatch raises DockerBuildContextChangedError before any build API call. Local builds reject the parameter with remote=True required.

Context archiving now builds normalized tar metadata with lstat-based entries and hashes file contents as they are written, so hard-linked paths stay distinct and identity ignores mtime/compression. SandboxImageSummary gains optional ready (separate from uploaded) for backward-compatible image listing.

^{Reviewed by Cursor Bugbot for commit 7e02540. Bugbot is set up for automated code reviews on this repo. Configure here.}