`removeDockerImage` cannot delete any image that has child images

[rtholmes]

This work hasn't been done yet because it isn't clear how much of a problem it is in production. We'll figure this out during 26W1.

DELETE /docker/image/:tag fails for any grading image that has dependent child
layers — which is the normal state after a rebuild.

removeDockerImage (packages/autotest/src/server/AutoTestRouteHandler.ts:423)
resolves :tag to an image Id (img.Id.indexOf(tag), line 450) and then calls
image.remove() (line 459). Docker rejects that:

(HTTP code 409) conflict - unable to delete 7eb80100254d (cannot be forced)
                         - image has dependent child images

cannot be forced is the key part — no flag makes remove-by-Id work. The handler
catches the error and answers 400.

Impact: an instructor rebuilding a grading image accumulates a parent/child
chain, so image cleanup from the admin UI stops working. (The existing comment at
line 477, "unclear what happens with these in production", is this.)

Ruled out: rebuilding under a second tag doesn't help. Docker reuses the cache
and returns the same Id, so remove() yields only Untagged entries, and the
success check at line 462 requires a Deleted entry — still 400.

Likely fix: untag instead of remove-by-Id when the image has children —
docker.getImage(tag).remove() — and accept Untagged as success.

Repro: run the image-build test twice, then attempt the delete. On a fresh
daemon a just-built image has no children yet and removal may succeed, so this is
intermittent by environment.

Test: "Should be able to remove a docker image." in
packages/autotest/test/AutoTestServerSpec.ts:281 is disabled for exactly this
reason and should be re-enabled with the fix. Full diagnosis is in the comment
block there.