feat(agents-api): provision isolated Docker runtimes

[SaladDay]

Docker-managed Environments need a reusable Runtime allocation path instead of test-specific docker run wiring. Add the five-operation Provider contract and a thin official Docker SDK adapter, plus a binary-bundle build for the colocated daemon, stock Codex and local filesystem helpers. Core and the existing execution/Files paths remain separate from provider initialization.

Bootstrap injects the existing daemon credential profile into a private named volume before startup. Allocation references survive failures; repeated creation cannot replace credentials or retained history. Compute observations stay distinct from native readiness. Cleanup checks ownership and explicitly removes both the container and its named volumes; uncertain initialization commands require reclamation before reuse.

Validation:

• Full server make check passed (522 seconds).
• Actual Docker race/lifecycle tests passed, covering bootstrap, duplicate/foreign ownership, retained volumes, command status/timeout and confirmed cleanup.
• Runtime image build and nonroot configuration/version checks passed. Actual Core, PostgreSQL, authenticated Runtime, stock Codex and real Kimi workflow passed (223 seconds): fixed SDK/raw Files, model consumption, isolation, cancellation, retained-history restart and missing-history refusal.
• Fresh independent whole-diff blind review found no actionable issues; reviewer independently reran actual Docker Provider tests and checked source-to-evidence hashes. The reviewer did not repeat the full gate/model session; lost acknowledgements and external Docker races were code-reviewed, not fault-injected.

This delivers the Provider/Runtime foundation. Public hosted Session admission, durable provisioning/expiry integration and user-managed enrollment remain unfinished; no default route changes or complete protocol-compatibility claim. No API/schema changes; OpenAPI/sqlc regeneration is not applicable. The initial image's inaccessible requirements directory was corrected and the failed attempt retained.