Switch hadolint to hadolint-coatl in the dev extra

[adamtheturtle]

Replaces the remote AleksaC/hadolint-py prek repo with hadolint-coatl==2.15.1 in the dev extra, run through a local prek hook (uv run --extra=dev hadolint) so its version is managed alongside the other tools, matching how shellcheck and shfmt are already handled. hadolint-py could not be used as a dependency because its published macOS wheel is a corrupt archive — uv and zipfile.testzip() both fail on it with deflate decompression error: invalid block type.

Also overrides the corrupted_image_file fixture in tests/conftest.py. vws-test-fixtures 2026.8.23 changed it to keep only the eight byte PNG signature, and real Vuforia answers an image with no data after the signature with a 500 rather than a BadImage response, which broke test_corrupted in test_add_target.py and test_update_target.py on main. Truncating the PNG part way through instead gives BadImage from real Vuforia while still being unopenable by Pillow, so the mock backends agree.

One caveat: hadolint-coatl tags its macOS wheel macosx_26_0_arm64, so contributors on older macOS or Intel Macs will not be able to install the dev extra.

Closes #3427

🤖 Generated with Claude Code

[adamtheturtle]

Rebased onto main and dropped the Override the corrupted image fixture commit.

That override existed because the old vws-test-fixtures corrupted_image_file kept only the eight byte PNG signature, which real Vuforia answered with a 500 rather than BadImage. #3501 bumped vws-test-fixtures to 2026.8.26, which fixes that fixture upstream, so a local override would now shadow the correct one.

This PR is back to just the hadolint to hadolint-coatl switch. All prek hooks pass locally on macOS across the pre-commit, pre-push and manual stages, including the hadolint hook itself — which is the case the switch is for.