[Bug]: Stale infrastructure images appear in `container image ls` after a CLI upgrade

### I have done the following

- [x] I have searched the existing issues
- [x] If possible, I've reproduced the issue using the 'main' branch of this project

### Steps to reproduce

1. Install a release whose containerization dependency is version A, and run any container once (`vminit:A` is fetched).
2. Upgrade to a release pinned to containerization version B.
3. `container image ls`

Observed on a store that lived through such an upgrade (engine at containerization 0.40.1, store still holding the 0.35.0-era init image):

```
ghcr.io/apple/containerization/vminit 0.35.0 5708d65ba191 arm64 66,9 MB
```

The current version's `vminit:0.40.1` is correctly hidden; the leftover `0.35.0` is listed as if the user had pulled it.

### Problem description

`Utility.isInfraImage` compares full references, so it only recognizes the vminit and builder images at the exact version the running build would pull. The copy left behind by any previous version — same repository, older tag — surfaces in every image list, looking like something the user pulled and forgot. Every user who upgrades across a containerization bump ends up with one.

Nobody pulls an init or builder image deliberately, so any tag of a configured infrastructure repository is infrastructure. The fix we run in production also matches on the reference with its tag or digest removed (finding the tag colon after the last path separator, so a registry with a port such as `registry.local:5000/repo` is not truncated at the port). Happy to open a PR.

### Environment

- OS: macOS 26.6 (25G72)
- Xcode: 26.6 (17F113)
- Container: 1.2.0 (`isInfraImage` unchanged on main at abff418)

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

Start at Utility.isInfraImage and trace the filtering used by `container image ls`; reproduce the issue with an older vminit tag and, if possible, a registry port. Done means infrastructure images from older configured versions are hidden while ordinary pulled images remain listed, including references such as `registry.local:5000/repo`.

Written by the indexing model from the issue text.