WIP: dockerize audited repository

[sinachaichi]

Work in progress, not ready to merge.

Implements extra objective:
generating and verifying a Dockerfile/compose for the advisory's repository when missing.

Verified end to end against real repositories (Grafana, n8n, pyLoad):
deterministic classification, LLM tie-breaker for ambiguous cases, sandboxed generation-verify-repair loop all work as designed. Output validation correctly rejects malformed generations rather than passing them to Docker.

Known limitations, documented but not yet resolved:

• Classifier signals cover common Python/Node/Go conventions but miss several frameworks (Next.js, Rails, Phoenix, and others).
• Generation is occasionally unstable on large monorepos, producing garbled structured output a few times during testing; validation catches this and reports GENERATION_FAILED rather than passing it through, but the underlying success rate of generation itself has not been measured systematically.
• Verification requires the application to actually start and answer HTTP; real-world repositories needing secrets, external services, or database migrations to boot will fail verification even with a correct Dockerfile, which is inherent to what "successfully runs" requires, not a bug in this implementation.

Next step before merging:
measure success rate (application detection accuracy, generation success, build success, verification success) across a larger sample of real advisories, similar to the eval harness already built for the main tracing pipeline.