refactor(image-cache): replace warn_if_stale with StaleImageError; add launch template

- image_cache: StaleImageError exception + check_stale/check_stale_path (raise instead of warn)
- BottleBackend.launch: template method (skip_stale flag) that calls _image_stale_checks then _launch_impl
- Each backend: _image_stale_checks delegates to a stale_checks() function in its launch module; _launch_impl replaces launch override
- macos_container: adds image_created_at to util, cached-image support in _build_images, stale_checks
- cli/start.py: catches StaleImageError, prompts interactively, retries with skip_stale=True; headless mode dies on it

bot_bottle/cli/start.py

@@ -36,6 +36,7 @@ from ..bottle_state import (
     is_preserved,
     mark_preserved,
 )
+from ..image_cache import StaleImageError
 from ..log import info, die
 from ..manifest import Manifest, ManifestIndex
 from ._common import PROG, USER_CWD, read_tty_line
@@ -555,30 +556,38 @@ def _launch_bottle(
             return 0
 
         backend = get_bottle_backend(backend_name)
-        with backend.launch(plan) as bottle:
-            agent_provider_template = getattr(plan, "agent_provider_template", "claude")
-            extra_args: tuple[str, ...] = ()
-            if headless_prompt_text:
-                extra_args = tuple(
-                    get_provider(agent_provider_template).headless_prompt(
-                        headless_prompt_text
+        skip_stale = False
+        while True:
+            try:
+                with backend.launch(plan, skip_stale=skip_stale) as bottle:
+                    agent_provider_template = getattr(plan, "agent_provider_template", "claude")
+                    extra_args: tuple[str, ...] = ()
+                    if headless_prompt_text:
+                        extra_args = tuple(
+                            get_provider(agent_provider_template).headless_prompt(
+                                headless_prompt_text
+                            )
+                        )
+                    exit_code = attach_agent(
+                        bottle,
+                        agent_provider_template=agent_provider_template,
+                        startup_args=plan.agent_provision.startup_args + extra_args,
                     )
-                )
-            exit_code = attach_agent(
-                bottle,
-                agent_provider_template=agent_provider_template,
-                startup_args=plan.agent_provision.startup_args + extra_args,
-            )
-            info(
-                f"session ended (exit {exit_code}); "
-                f"container {bottle.name} will be removed"
-            )
-            # While the container is still alive: always snapshot the
-            # transcript and — if the agent exited non-zero — mark
-            # the state for preservation. This picks up crashes /
-            # Ctrl-Cs / OOM kills before cleanup removes the state dir.
-            if agent_provider_template == "claude":
-                capture_claude_session_state(identity, exit_code)
+                    info(
+                        f"session ended (exit {exit_code}); "
+                        f"container {bottle.name} will be removed"
+                    )
+                    if agent_provider_template == "claude":
+                        capture_claude_session_state(identity, exit_code)
+                break
+            except StaleImageError as exc:
+                if assume_yes:
+                    die(str(exc))
+                sys.stderr.write(f"bot-bottle: {exc}\nLaunch anyway? [y/N] ")
+                sys.stderr.flush()
+                if read_tty_line() not in ("y", "Y", "yes", "YES"):
+                    break
+                skip_stale = True
         return 0
     finally:
         # PRD 0018 chunk 2: prepare now writes the bottle's bind-mount