Fix Docker participant profiles in storage-first workflow

[mellowcroc]

Summary

• separate the host proof-tool companion measured during Docker setup from the fixed in-image proof-tool executable
• accept existing Docker participant profiles that retained the measured host path
• keep every Docker inspection and contribution pinned to /usr/local/bin/mpc-ceremony inside the immutable image

Validation

• go test ./... -count=1
• go vet ./...
• bash scripts/test-install-launcher.sh
• added focused profile, setup-default, fixed-entrypoint, and opt-in guided Docker onboarding coverage

Tessera compatibility

No setup contract, Tessera request, storage object, or existing frozen ceremony changes. Existing profiles remain usable without editing or recreation.