Modal backend still only returns figures the code called plt.show() on

Follow-up from #74 / #81.

#81 made figure interpretation uniform: every backend returns figures as rich outputs and the parent process is the only place a vision model runs. It also made capture independent of `plt.show()` — but only for the backends whose kernel lives in this repo.

`code_execution.IPythonSession` now publishes any matplotlib figure the cell left open once the cell finishes, so `--backend local` and `--backend process` return a figure whether the code showed it, saved it, or just left it open.

`--backend modal` runs asta-sandbox's own kernel (`ModalEphemeralExecutor`), which this repo does not control. The inline backend there still only publishes on `plt.show()`, so a figure the experiment code saved with `plt.savefig` is silently never interpreted and never reaches `rich_outputs/`.

## Options

- Flush open figures in asta-sandbox's kernel, matching what `IPythonSession` does. Fixes it for every asta-sandbox consumer, and is where the fix belongs.
- Or fold it into #55: that issue moves `ProcessIPythonBackend` into asta-sandbox, at which point the flush travels with it and `modal` can share the same behavior.

The experiment programmer's system message currently tells the agent to "use plt.show (not plt.savefig)", which is why this has not bitten hard. That instruction is a workaround for this gap, and can be relaxed once it closes.

Suggested-by: @radamson