[Bug]: Environment variables can be duplicated on run

### I have done the following

- [x] I have searched the existing issues
- [ ] If possible, I've reproduced the issue using the 'main' branch of this project

### Steps to reproduce

`container run` does not fully override environment variables of the underlying image.

1. provide a default `ENV` variable in a Dockerfile (e.g. )
2. attempt to override it when running the image e.g. `container run -e OLLAMA_HOST=ollama.local:11434 alpine/ollama ps`
3. the executable does not behave as though the variable is set (in this case it complains "Error: could not connect to ollama server, run 'ollama serve' to start it")

### Current behavior

The reason can be seen by inspecting the container's environment via e.g. `container run -e OLLAMA_HOST=ollama.local:11434 --entrypoint=/usr/bin/env alpine/ollama` which reveals:

```
PATH=/usr/local/sbin:/usr/local/bin:/usr/bin:/usr/sbin:/sbin:/bin
SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
OLLAMA_HOST=0.0.0.0
OLLAMA_HOST=ollama.local:11434
HOME=/root
```
so when the normal entrypoint calls some equivalent of `getenv("OLLAMA_HOST")` it receives the value of the *first* entry rather than the last.

Note that this behavior is masked by any intervening shell. For example running `container run -e OLLAMA_HOST=ollama.local:11434 --entrypoint=/bin/sh alpine/ollama -c env` outputs the actually-desired outcome instead:

```
SHLVL=1
HOME=/root
OLLAMA_HOST=ollama.local:11434
SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
PATH=/usr/local/sbin:/usr/local/bin:/usr/bin:/usr/sbin:/sbin:/bin
PWD=/
```

I'm assuming `sh` (or perhaps any intervening process) must have the effect of cleaning up its environment and removing the duplicates.

### Expected behavior

The output of `docker run -e OLLAMA_HOST=ollama.local:11434 --entrypoint=/usr/bin/env alpine/ollama` is simply:

```
PATH=/usr/local/sbin:/usr/local/bin:/usr/bin:/usr/sbin:/sbin:/bin
HOSTNAME=d64b91a7b258
TERM=xterm
OLLAMA_HOST=ollama.local:11434
SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
HOME=/root
```

i.e. with only the version of `OLLAMA_HOST` from the invocation, not from the Dockerfile.

### Environment

```markdown
- OS:
- Xcode:
- Container:
```

### Relevant log output

```shell
N/A
```

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

Start by tracing how `container run` assembles the environment from Dockerfile `ENV` values and `-e` overrides, then reproduce the issue with `--entrypoint=/usr/bin/env`. Done means an overridden variable appears only once with the invocation's value, and the normal entrypoint receives that value through `getenv`.

Written by the indexing model from the issue text.