Restrict launches to prepared runtimes (Refs #93)

docs/guides/native-hosts.md

@@ -243,10 +243,15 @@ servers. Existing API clients may still explicitly constrain a launch to a host.
 Queued jobs retain their accepted game-file version. Automatic host preparation
 also downloads the game files needed by unplaced jobs; a newer upload does not
 remove files still needed by the queue. Only the configured default runtime is
-pulled automatically. Custom images must already be cached on the selected host,
-or on an active host for automatic placement, before a launch is accepted. Admins
-can prepare them from the host page. Queued launches and migrations never trigger
-custom image pulls, and container creation cannot implicitly pull a missing image.
+pulled automatically. Custom images must have been prepared by an admin from the
+selected host's page, or on an active host for automatic placement, before a launch
+is accepted. An image cached by another Docker workload does not qualify. Agent
+1.8.6 reports these exact prepared references from `runtime-images.json` while
+their image IDs remain cached; the controller also trusts its configured default
+when cached. Host pages and APIs expose only prepared runtimes. Older agents can
+still run the configured default, but must update before accepting custom runtimes.
+Queued launches and migrations never trigger custom image pulls, and container
+creation cannot implicitly pull a missing image.
 
 ### Resource samples and learned allowances