Docs run Docker commands on container names that workspace scoping replaced #1350

Problem

Since #1054 (d9dfbb6, 2026-09-17), LilRAE gives each container it creates a workspace-scoped Docker name, aptl-w<id>-<name> (container_name in src/aptl/core/deployment/_compose_resource_ownership.py). aptl container shell and aptl container logs resolve the logical name, for example aptl-kali. Plain docker exec, docker logs and docker cp do not, so a command on the fixed name fails with "No such container" on a current lab.

User docs still run Docker commands on the fixed names:

• docs/workshop/arsenal-2026/qa.md (12 lines), docs/workshop/walkthrough.md (5) and docs/workshop/arsenal-2026/facilitator.md (3).
• docs/components/wazuh-siem.md (5) and docs/components/wazuh-active-response.md (5).
• docs/components/victim-containers.md has 12 more, below the historical-record notice that docs: align runtime documentation and tests with the shipped lab #1263 adds.

Several of them run docker exec aptl-kali. On TechVault, LilRAE refuses aptl container shell aptl-kali while session capture runs (_compose_queries.py, container_shell), because the capture broker only records sessions that arrive over SSH through the capture sidecar. A raw docker exec into Kali is neither refused nor captured.

Scope

• Replace each Docker command on a fixed aptl- name with aptl container shell or aptl container logs where they cover it, or with the workspace-scoped name that aptl container list shows.
• Route the Kali steps through the red-team MCP server or the operator-access relay, as docs/components/kali-redteam.md describes, so the session is captured.

Done when

• No user doc outside a dated historical record runs docker exec, docker logs or docker cp on a fixed aptl-<name> container name.
• The workshop Kali steps use a path that the capture broker records.

Related

• Align Kali, port, and socket docs and stale references with the shipped runtime #954, docs: align runtime documentation and tests with the shipped lab #1263, feat: scope backend resource ownership #1054, Refuse a direct Kali shell during capture whichever name or ID selects the container #1271