Fix Docker API compatibility gaps and native macOS icon packaging

[mbianchidev]

Summary

• Bundle native macOS .icon artwork while preserving .icns, with no warning suppression.
• Address the six audited protocol gaps in Complete Docker Engine API compatibility for standard clients and development tools #98: real Linux-backend CPU totals/counts and previous samples; exhaustive non-default option preflight; API 1.41–1.47 enforcement and response shaping; immutable event actor attributes; flushed transfer progress and cancellation cleanup; truthful backend metadata.
• Add current Docker SDK contracts and native CLI coverage, including Windows named pipes.
• Add real Dev Containers/Testcontainers workflows, valid/corrupt image archives, ordinary save/load/tag/push, and a disposable registry against isolated Linux containerd and native macOS/Windows Lima backends.
• Fix the real-client gaps uncovered by those workflows: uploaded tar build contexts, rootless systemd task placement, guest-native architecture/log paths/helper lookup, binary logger argv, Dockerode names/HTTP exec/log-tail conventions, Windows binary archive transport, default local volume creation, and managed-container cleanup.
• Document the endpoint/option/version matrix and tested configuration limits. Dev Containers uses a named workspace volume; the harness owns Testcontainers cleanup with Ryuk disabled. No guest receives the host control socket.

Refs #98. This is a draft for human review, not a claim of unrestricted drop-in compatibility or a release.

Validation

• All CI and CodeQL checks passed on 5690f73, including all three real development-client jobs and both native installer jobs: CI run.
• Real busy-workload CPU percentages, SDK/CLI exec, archive save/load, corrupt-archive rejection, ordinary tag/push, Testcontainers log-wait/exec/removal, and Dev Containers up/post-create/exec/removal passed against local Linux containerd, macOS Lima, and Windows Lima over a named pipe.
• Go repository tests/build/vet/module checks, Docker race checks, dashboard lint/build, workflow validation, and client dependency installation/audits passed.
• Patched Go 1.27.2 reports zero reachable/imported-package vulnerabilities. The module-only x/crypto OpenPGP advisory has no fixed version; Porto does not import or call OpenPGP.
• Both local guarded macOS DMGs and desktop archives were built with Go 1.27.2. Both DMGs passed hdiutil verify; the Apple Silicon image is opened for manual installation. No app was copied into Applications.
• No unresolved review threads are present.

CI warning

Hosted macOS has no nested hypervisor support, so its client fixture intentionally uses QEMU software emulation. Lima emits the expected HVF-unavailable warning; the real workflow and CPU assertions still pass. The existing desktop VM was not restarted or modified to bypass its SSH connection limit.