use build guid for container handle

hijacking is now done as a straight container lookup via the requested guid.
this eliminates a race condition between the builder starting and
attaching, and allows hijacking to work so long as the container is
still alive.

so, to support hijacking even after a build finishes, all we have to do
at this level is not destroy the container, and allow Garden to reap it
after its grace period.

generally, as much data as possible should be placed on the container
instead of maintained in-memory.