Stop local CI writing the shared mutable test image tag

The run built per-run images and then retagged them to fips-test:latest as
a compatibility bridge for the consumers that had never been migrated. The
bridge was the defect: while it existed, two concurrent runs shared one
binding, so a suite could start containers from the other run's binaries
and the verdict was recorded against a commit whose code never ran. It
fails silently by construction — the run is green either way, and nothing
compares a running container's binary against the commit under test.

Every consumer now reads the run's image, so the retag is deleted rather
than kept. That is the point of deleting it: a consumer that was missed
fails loudly instead of quietly resolving whichever run wrote the tag last.

Two consequences handled here. The cleanup script ran ip(8) inside
fips-test:latest to reap simulation interfaces, and nothing writes that tag
any more, so it now takes the caller's image, then the run's, then any
surviving test image — the last of which is what keeps an unscoped --reap
working, since that path execs before the run identity is exported. And a
guard checks statically that nothing names the shared tag, because on a
host with a hand-built copy lying around a reintroduction would run green;
it is break-checked against a reintroduced compose consumer and a
reintroduced default. Both runners gate on it, as they do the other guards.

testing/README.md

@@ -93,8 +93,21 @@ flight) never collide:
 - **Compose projects** are named `fipsci_<run-id>_<suite>`, so
   container, network, and volume names are all prefixed per run.
 - **Build images** are tagged `fips-test:<run-id>` and
-  `fips-test-app:<run-id>` (exported as `FIPS_TEST_IMAGE` /
-  `FIPS_TEST_APP_IMAGE` for the compose consumers).
+  `fips-test-app:<run-id>`, exported as `FIPS_TEST_IMAGE` /
+  `FIPS_TEST_APP_IMAGE`, and **every** compose file and suite script reads
+  those. The run does not write `fips-test:latest` at all: a bridge back to
+  that shared mutable name would let a consumer that had been missed keep
+  working while resolving whichever concurrent run wrote the tag last.
+  `:latest` stays the hand-build name, produced by
+  `testing/scripts/build.sh`, and remains the default every consumer falls
+  back to when the variables are unset.
+- **The build context** is a per-run copy at `testing/docker-<run-id>/`,
+  exported as `FIPS_BUILD_CONTEXT`. It is absolute because compose resolves
+  a relative build context against the compose file's own directory rather
+  than the working directory. `testing/docker/` is the hand-run context and
+  a CI run does not write to it. Without this, two runs race on the contents
+  of one directory and either can build a correctly-per-run-tagged image
+  from the other's binaries.
 - Each parallel chaos child gets a unique, non-overlapping `/24` in
   `10.30.x` (via the sim `--subnet` override). `10.30.x` sits outside
   Docker's default address pool and the fixed-subnet suites' `172.x`