feat(docker): add provisioning progress events

[drew]

Summary

Add Docker driver provisioning progress events so sandbox creation can return after validation while image pull and container startup continue in the background.

Related Issue

N/A

Changes

• Track pending Docker sandboxes in memory and surface them through get/list/watch snapshots while provisioning runs.
• Emit Docker platform progress metadata for sandbox allocation, image cache hits/pulls, layer pull progress, container creation, startup, and provisioning failures.
• Handle delete/stop operations for pending Docker sandboxes and clean up token files consistently.
• Configure local gateway:docker runs with generated sandbox JWT material so Docker supervisors can authenticate back to the gateway.
• Fail Docker sandbox creation early when gateway JWT auth is missing instead of starting a restart-looping container.
• Add Docker driver tests for progress metadata and pending sandbox snapshots.
• Update Docker runtime architecture and driver README documentation.

Testing

• mise run pre-commit passes
• cargo test -p openshell-driver-docker passes
• bash -n tasks/scripts/gateway-docker.sh passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)