Create a short-lived image path for an exe.dev VM or Docker pull.
The tag and token path are removed at expiry. Issue a new grant when needed.