fix: handle SELinux Docker mounts and stale VM images

[alvarmaciel]

Summary

Fixes two local image workflow issues:

• Add SELinux relabeling to the Docker bind mount used by the kernel builder.
• Detect existing VMs that reference missing boot artifacts before starting QEMU.

Details

On SELinux-enabled hosts, the kernel build step could fail with:

bash: /work/build.sh: Permission denied
The file existed and had executable permissions, but Docker could not read the bind-mounted temporary workdir because it was not relabeled for container access. The kernel builder now mounts /work with :z.
Separately, existing VMs could retain stale kernel_path or rootfs_path values pointing into temporary directories that no longer exist. In that case, QEMU exited early with an opaque missing-file error. sbx run now checks those paths first and tells the user to recreate the VM.
Testing
- pytest --no-cov tests/test_build_debian_image.py
- pytest --no-cov tests/test_cli.py::test_start_existing_vm_with_missing_kernel_suggests_recreate tests/test_cli.py::test_run_existing_error_vm_suggests_recreate tests/test_cli.py::test_run_existing_vm_starts_without_creating
- ruff check src/sbx/image/build_debian.py tests/test_build_debian_image.py src/sbx/cli.py tests/test_cli.py