deps: docker CLI 29.8.2

[zcsizmadia]

Bumps the bundled docker CLI from 29.8.1 to 29.8.2 for 0.9.0.

	value	how it was obtained
DOCKER_CLI_SHA	7fc2dff9bceb96b266a3b2c3117c0955a0d9e616	git ls-remote … 'refs/tags/v29.8.2^{}'; the same query reproduces the current 29.8.1 pin
amd64 zip sha256	e8a956a1f117764dd79f6b1964eca0bb451088fe2db5ecce93ed0e01e5d814b3	computed from the official download.docker.com zip (upstream publishes no checksum); docker/docker.exe entry confirmed present
GO_VERSION	1.26.8	kept in step with the engine bump, which needs it (moby, containerd and BuildKit all require 1.26.8); docker/cli's own floor is 1.26.0

arm64 is a placeholder in this PR, on purpose. The arm64 docker.exe is built by dockercli.yml from a dockercli-v29.8.2 tag, and that tag has to be cut from a main that already pins 29.8.2. So the arm64 entry is empty (URL and sha256 together, which Published() reads as "not available on this platform") until that release exists. After merge:

1. tag dockercli-v29.8.2, --latest=false
2. a follow-up PR puts the published URL and .sha256 into the manifest

Both happen before 0.9.0 is tagged, so no release ships without an arm64 CLI.

Verified: a dev build's skrog cli install downloaded the 29.8.2 zip, verified it against the pinned checksum, and installed it. docker version reports client 29.8.2 at commit 7fc2dff, and docker run --rm alpine works against the 29.8.1 engine. go test ./internal/dockercli/... ./cmd/skrog/ passes. TestArm64DockerCLIComesFromOurOwnRelease skips while arm64 is a placeholder, as designed.