fix(screener): screen starter-kit with Kaniko identity contract

[Peyton-Spencer]

Summary

• Encode the production Targon/Kaniko miner-screen contract: destination ditto-screen/{agent}-{attempt}:latest, --no-push --tar-path, and screened_image_id = docker-save config digest (never Kaniko --digest-file or Artifact Registry manifest digest).
• Add scripts/targon-screen-starter-kit.sh to docker-build the starter-kit harness (or --tiny) with that destination and fail closed if the saved tar would not score.
• Accept Kaniko sha256:<hex> config member names in Platform's docker-save helper so it matches the submission-builder and DittoBench.

Validation

• uv run pytest tests in services/screener-orchestrator (89 passed)
• uv run pytest ditto/tests/api_server/test_docker_save_archive.py in apps/platform (6 passed)
• go test ./internal/sandbox -run Kaniko in services/dittobench-api
• bash scripts/targon-screen-starter-kit.sh --tiny — busybox image validated
• bash scripts/targon-screen-starter-kit.sh — starter-kit harness built and validated (ok: true, attempt-scoped RepoTags, config digest sha256:4c32f3dc…)
• bash scripts/targon-smoke.sh inventory — Targon cpu-small available (29)

Activation

• Do not merge until review. After merge, Platform/screener deploys follow semantic-release; the script is operator-local and does not change live Targon settings.
• Live Targon Kaniko capability remains scripts/targon-smoke.sh kaniko-probe --resource cpu-small (optional --live on the starter-kit script).