refactor(sandbox): use Docker Engine Go client

[yanpgwang]

What changed

• Replace every runtime docker CLI subprocess with the supported github.com/moby/moby/client Engine API client.
• Use typed create, inspect, list, start, kill, remove, exec, image-pull, and archive-copy operations with automatic API-version negotiation.
• Preserve durable container IDs, idempotent Session naming, timeout teardown, and File/Skill/Memory bind-mount behavior behind the existing sandbox interfaces.
• Resolve standard Docker auths, credsStore, and credHelpers configuration for cold pulls of private images.
• Wait for the final Engine exec state before accepting its exit code, including cancellation-aware polling.
• Remove CLI-based test probes and document Engine, registry-auth, DOCKER_HOST, and Docker TLS behavior.

Verification

• make verify
• make test-service
• make docs-check
• make local-config
• make security
• Real Docker conformance, restart attach, exec/timeout, binary file, File Resource, Skill, and Memory mount tests passed.
• Targeted tests cover final exec-state polling, registry-auth forwarding, rejected-create cleanup, and start-failure cleanup.
• Independent Claude Code review initially requested changes for exec-state and private-image regressions. After the fixes and full re-review at b2c0d22, the final verdict was APPROVE with no merge-blocking findings.

Compatibility

There are no HTTP, event, database, or persisted sandbox-reference changes. Existing Docker bindings still store and attach by container ID. Docker 29 and later publish github.com/moby/moby/client and github.com/moby/moby/api as the supported Go modules: https://github.com/moby/moby#go-modules

Durability and security

Container names remain provider-side idempotency keys, and ambiguous create acknowledgements retain their bind source for attach/audit recovery. Definite daemon rejections and acknowledged cleanup remove their staging roots. Cleanup uses bounded fresh contexts and remains idempotent on missing containers. File reads consume Engine tar streams in memory and reject non-regular archive entries without materializing them on the worker host; container-side path resolution retains Docker archive semantics.

Checklist

• Tests cover the changed behavior.
• Public behavior is documented.
• Compatibility claims cite official sources.
• No credentials, generated build output, or local databases are included.