Verify the IMAGES passthrough on a box (Astro, Railway) #274

#270 adds the images binding (#222). On the desktop and the box it is a passthrough: /_image returns the original image, and the host binds env.ASSETS and a no-op caches global for it. This was checked on a desktop dev build only. The box runs the same generated host, but nobody has run it there.

Check

1. Take the same Astro sample app as the edge check and add targets.box: { provider: "railway" }.
2. Run rustybuns build box, then deploy to the railway-test project.
3. Request /_image?href=…&w=32&f=webp. It should return 200 with the original PNG, byte-identical to dist/client/_astro/*.png.
4. Tear down the service afterwards. railway-test itself stays.

Done when step 3 passes and the result is noted in FRAMEWORKS.md.