refactor(plugin): centralize workload conversion + container cleanup

Three packages (api, reconciler, webhook) each carried a private 30-line
toPluginWorkload() copy that had drifted — only the api version logged
malformed public_faces JSON; the others swallowed it. Hoist the single
implementation to plugin.WorkloadFromStore() (convert.go); store is
already a plugin dependency so no new import edge or cycle forms.

Likewise the dockerfile and static sources each had a private
removeContainerByName() that disagreed (remove-all vs stop-at-first).
Docker enforces unique container names, so the two were equivalent for
every reachable state; converge on plugin.RemoveContainerByName()
(container.go, stop-at-first) with a note on why remove-all was moot.

Callers migrated; old copies removed. Adds convert_test.go pinning the
field-by-field contract and JSON edge cases.

internal/workload/plugin/source/static/deploy.go

@@ -289,7 +289,7 @@ func deploy(ctx context.Context, deps plugin.Deps, w plugin.Workload, intent plu
 			deps.Docker.StopContainer(ctx, prevContainerID, 10)
 			deps.Docker.RemoveContainer(ctx, prevContainerID, true)
 		}
-		removeContainerByName(ctx, deps, containerName)
+		plugin.RemoveContainerByName(ctx, deps, containerName)
 
 		containerID, err = deps.Docker.CreateContainer(ctx, cc)
 		if err != nil {
@@ -517,23 +517,6 @@ func publishEvent(deps plugin.Deps, w plugin.Workload, status string) {
 	plugin.EmitDeployEvent(deps, w, "static_site", status)
 }
 
-// removeContainerByName mirrors the legacy helper: enumerate Docker's
-// view and best-effort drop the matching container so a name conflict
-// in CreateContainer is recoverable. Best-effort.
-func removeContainerByName(ctx context.Context, deps plugin.Deps, name string) {
-	containers, err := deps.Docker.ListContainers(ctx, nil)
-	if err != nil {
-		return
-	}
-	for _, c := range containers {
-		if c.Name == name {
-			deps.Docker.StopContainer(ctx, c.ID, 10)
-			deps.Docker.RemoveContainer(ctx, c.ID, true)
-			return
-		}
-	}
-}
-
 // primaryDomain derives the public-facing FQDN from the workload's
 // first enabled public face. Static workloads support at most one
 // face today, but iterate defensively in case the API contract