build(tensorrt): scope JP7 build changes to reduce blast radius

Gate the docker/main/Dockerfile pip --ignore-installed workaround behind a
PIP_IGNORE_INSTALLED build arg that is empty for every stock image and set
only for the JP7 (Ubuntu 24.04 noble) TensorRT base. Non-JP7 images now build
a byte-identical command. Revert the ov-converter change entirely since that
stage is always debian:12, never noble.

Drop the incidental shell re-quoting in the trt-model-prepare run script,
keeping only the functional TensorRT-major-aware runtime library check
(.so.8 on JP6, .so.10 on JP7; libnvparsers removed in TRT 10).

docker/tensorrt/trt.hcl

@@ -31,6 +31,9 @@ variable "L4T_APT_RELEASE" {
 variable "JETSON_SOC_REPO" {
   default = ""
 }
+variable "PIP_IGNORE_INSTALLED" {
+  default = ""
+}
 variable "BASE_HOOK" {
   # Ensure an up-to-date python 3.11 is available in jetson images
   default = <<EOT
@@ -59,6 +62,7 @@ target "_build_args" {
     TENSORRT_PYTHON_BRANCH = TENSORRT_PYTHON_BRANCH,
     L4T_APT_RELEASE = L4T_APT_RELEASE,
     JETSON_SOC_REPO = JETSON_SOC_REPO,
+    PIP_IGNORE_INSTALLED = PIP_IGNORE_INSTALLED,
     BASE_HOOK = BASE_HOOK
   }
   platforms = ["linux/${ARCH}"]