ci: tag images by bare commit sha + sync c_abi guardrail

- docker.yml: emit short + long sha tags without `sha-` prefix so every
  image carries the commit hash directly (previously `sha-abc1234`).
- check_c_abi_runtime.py: add `strategy_set_trade_start_time` to the
  EXPECTED_RUNTIME allowlist; the runtime impl in src/c_abi.cpp landed
  in 76482e6 but the guardrail was not updated, breaking CI on main.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: luisleo526

.github/workflows/docker.yml

@@ -62,7 +62,8 @@ jobs:
             type=ref,event=pr
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
-            type=sha,format=short
+            type=sha,format=short,prefix=
+            type=sha,format=long,prefix=
             type=raw,value=latest,enable={{is_default_branch}}
 
       - name: Build and push

scripts/check_c_abi_runtime.py

@@ -1,9 +1,9 @@
 #!/usr/bin/env python3
 """CI guardrail: runtime-side PF_API implementations in c_abi.cpp stay documented.
 
-The header lists ten harness-facing symbols; only ``strategy_set_trace_enabled`` and
-``pf_version_get`` are defined in the static runtime — the rest are emitted per-strategy
-by the transpiler (see comment in src/c_abi.cpp). If that split changes, update
+The header lists eleven harness-facing symbols; only the three in EXPECTED_RUNTIME
+are defined in the static runtime — the rest are emitted per-strategy by the
+transpiler (see comment in src/c_abi.cpp). If that split changes, update
 EXPECTED_RUNTIME below and the comment block in c_abi.cpp together.
 """
 
@@ -15,7 +15,11 @@
 
 ROOT = Path(__file__).resolve().parents[1]
 
-EXPECTED_RUNTIME = frozenset({"strategy_set_trace_enabled", "pf_version_get"})
+EXPECTED_RUNTIME = frozenset({
+    "strategy_set_trace_enabled",
+    "strategy_set_trade_start_time",
+    "pf_version_get",
+})
 
 _PF_API_DECL = re.compile(r"^\s*PF_API\b.+\b(\w+)\s*\(")