Pass `--metadata-file` through to `bakery build --strategy bake` invocations

[ianpittwood]

Context

bakery build --metadata-file was silently ignored on the --strategy bake path: the option
was accepted by the CLI and threaded to BakeryConfig.build_targets(), but the BAKE branch
never forwarded it to BakePlan.build(). Any bake-strategy build therefore produced no
metadata file, which blocks bakery dgoss run --metadata-file and bakery ci publish from
consuming bake output at all — and blocks the native-workflow migration tracked by the parent
epic.

python-on-whales 0.81.0 added metadata_file support to docker.buildx.bake(), matching the
existing docker.build() support, so this can now be wired straight through.

Work

• BakePlan.build() accepts metadata_file and forwards it to
  docker buildx bake --metadata-file.
• BakeryConfig.build_targets()'s BAKE branch passes metadata_file through and, on
  success, loads the resulting file back into each target's build_metadata via
  load_build_metadata_from_file(). No merge step is needed: buildx bake --metadata-file
  already writes one entry per target keyed by the same UID used in the bake plan, unlike the
  BUILD strategy which has to merge per-target temp files.
• Bump the python-on-whales lower bound to >=0.81.0.

Acceptance criteria

• bakery build --strategy bake --metadata-file <path> writes a UID-keyed metadata file.
• The written file loads back into ImageTarget.build_metadata for each built target.
• Unit coverage for metadata_file forwarding, default None behavior, and load-back.

Notes

Implemented in #733. The spike (#728) verified the resulting file is byte-shape compatible
with --strategy build output, so no consumer changes ride along with this.

[ianpittwood]

Implemented in #733 (branch feat/bake-metadata-files).