docs(inference): state why image absence proves the probe pull failed

The PR review advisor warned that the classifier could blame a pull for a
run failure it never observed. It cannot: `docker run` pulls an absent
image before it creates the container, and --add-host, policy, and
seccomp failures all happen after that pull. Five runs precede the
inspect check, so a pullable image would already be in the cache, and a
post-pull failure keeps the generic runtime diagnostic. Record that
invariant at the classifier so the next reader does not re-derive it.

Refs #9308

Signed-off-by: Dongni Yang <dongniy@nvidia.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: Dongni-Yang

src/lib/inference/local.ts

@@ -1239,6 +1239,13 @@ function containerRuntimeFailureDiagnostic(text: string): ContainerDiagnostic {
  * probe image. Credential-helper failures land here (#9308) — a remote login
  * session can lose access to Docker Desktop's credential store, so the pull
  * fails and every probe run produces empty stdout.
+ *
+ * Image-absent-after-run-attempts proves the pull failed: `docker run` pulls
+ * an absent image before it creates the container, and `--add-host`, policy,
+ * and seccomp failures all happen after that pull. Five runs precede this
+ * check (three probes, two diagnostics), so a pullable image would be in the
+ * cache by now and a run that failed for any post-pull reason keeps the
+ * generic runtime diagnostic.
  */
 function classifyContainerRunFailure(
   dockerCommand: string[],