refactor(plugin): centralize workload conversion + container cleanup

Three packages (api, reconciler, webhook) each carried a private 30-line
toPluginWorkload() copy that had drifted — only the api version logged
malformed public_faces JSON; the others swallowed it. Hoist the single
implementation to plugin.WorkloadFromStore() (convert.go); store is
already a plugin dependency so no new import edge or cycle forms.

Likewise the dockerfile and static sources each had a private
removeContainerByName() that disagreed (remove-all vs stop-at-first).
Docker enforces unique container names, so the two were equivalent for
every reachable state; converge on plugin.RemoveContainerByName()
(container.go, stop-at-first) with a note on why remove-all was moot.

Callers migrated; old copies removed. Adds convert_test.go pinning the
field-by-field contract and JSON edge cases.

internal/workload/plugin/source/dockerfile/deploy.go

@@ -260,7 +260,7 @@ func deploy(ctx context.Context, deps plugin.Deps, w plugin.Workload, intent plu
 			deps.Docker.StopContainer(ctx, prevContainerID, 10)
 			deps.Docker.RemoveContainer(ctx, prevContainerID, true)
 		}
-		removeContainerByName(ctx, deps, containerName)
+		plugin.RemoveContainerByName(ctx, deps, containerName)
 
 		containerID, err = deps.Docker.CreateContainer(ctx, cc)
 		if err != nil {
@@ -517,25 +517,6 @@ func healUnchanged(deps plugin.Deps, w plugin.Workload, prev runtimeState, lates
 	return nil
 }
 
-// removeContainerByName enumerates Docker's view and best-effort drops
-// EVERY matching container so a name conflict in CreateContainer is
-// recoverable. Container names are unique per daemon, but the recovery
-// path exists precisely because a conflict occurred — a prior partial
-// deploy can leave more than one matching artifact, so we must not stop
-// at the first. Mirrors the static plugin's helper of the same name.
-func removeContainerByName(ctx context.Context, deps plugin.Deps, name string) {
-	containers, err := deps.Docker.ListContainers(ctx, nil)
-	if err != nil {
-		return
-	}
-	for _, c := range containers {
-		if c.Name == name {
-			deps.Docker.StopContainer(ctx, c.ID, 10)
-			deps.Docker.RemoveContainer(ctx, c.ID, true)
-		}
-	}
-}
-
 // primaryDomain mirrors the static plugin's helper of the same name —
 // derives an FQDN from the workload's first enabled public face, with
 // the same bare-subdomain + settings.Domain fall-through.