Extract ImageService + ResourceService + StatsService; Agent becomes thin coordinator

Extract image handling, resource acquire/release (alloc_map allocate/free, PortPool allocate/free), and stat collection into services. Resource managers use the existing symmetric primitives (no new common interface). Agent becomes a thin coordinator over these + KernelService/LifecycleService. Priority target = Sokovan-driven ops (check_and_pull -> ImageService, assign_port -> ResourceService); commit/push/purge, scan_gpu_alloc_map etc. deferred.

Success Criteria:
- [ ] image/resource/stats flows route through their services with parity (via the #1 CLI).
- [ ] alloc_map + PortPool acquire/release owned by ResourceService (symmetric, idempotent release).
- [ ] AbstractAgent field/method count materially reduced (thin coordinator).
- [ ] pants test passes for affected packages

JIRA Issue: BA-6763

Start at AbstractAgent and trace the #1 CLI Sokovan paths, especially check_and_pull and assign_port. Compare the existing image handling, alloc_map and PortPool acquire/release, and stat collection with the proposed ImageService, ResourceService, and StatsService boundaries. Done means the targeted flows route through the services with parity, releases are symmetric and idempotent, affected pants tests pass, and AbstractAgent is materially thinner.

Written by the indexing model from the issue text.