runtime: Docker backend via bollard (start, stop, healthcheck, logs)

[pierrick-fonquerne]

Implement the first concrete runtime backend so the orchestrator can boot containers on a developer laptop running Docker.

Scope

• Define a ContainerRuntime trait abstracting the operations needed by the lifecycle manager.
• Implement DockerRuntime against the bollard crate.
• Operations: start, stop, healthcheck, log streaming, basic introspection.
• Error mapping from bollard errors to a domain error type using thiserror.

Acceptance criteria

• Trait plus Docker implementation compile and pass unit tests.
• Integration test using testcontainers starts and stops a real busybox container.
• Log streaming primitive emits structured events consumable by the future dashboard layer.
• Errors propagate without leaking bollard types in the public API.