fix(submissions): surface each linked build's outcome to the submitter

/me/submissions (and the admin queue) now attach build_status/build_error by
a read-only Builder.Get — until now a failed build was visible only on the
admin-tier /images/build routes, so the person who submitted the modpack
never learned the build died. A missing build row renders as "no outcome";
any other lookup failure surfaces instead of being swallowed. The panel's
My Submissions page renders the outcome in the expanded row, localised.

internal/api/images.go

@@ -15,6 +15,11 @@ import (
 // admin-tier (Zero Trust), enforced by adminOnly before these handlers run.
 type ImageBuilder interface {
 	Submit(ctx context.Context, req build.Request) (*build.Build, error)
+	// Get reads one build row without reconciling it — the read-only lookup the
+	// submission views use to surface a build's outcome to its submitter (the
+	// /images/build routes are admin-tier). State advance belongs to the
+	// reconcile loop (Sync/SyncAll), so a list render never touches the cluster.
+	Get(ctx context.Context, id string) (*build.Build, error)
 	// Sync reconciles a build against its Job and returns the current view, so a
 	// GET doubles as the reconcile tick (idempotent on terminal builds).
 	Sync(ctx context.Context, id string) (*build.Build, error)