feat(PRLT-1365): consolidate Docker runners into docker-management.ts

[chrismcdermut]

Summary

• Move runDocker (simple detached one-shot runner) from docker.ts into docker-management.ts so all Docker container creation lives in a single module.
• Delete apps/cli/src/lib/execution/runners/docker.ts entirely. No soft stubs.
• Move checkDockerDaemon / isDockerRunning / DockerDaemonStatus into docker-management.ts (their natural home), avoid circular import. shared.ts re-exports them so callers don't need to update.
• Move RunnerResult and Runner types from shared.ts into types.ts so docker-management.ts can use them without importing from shared.ts (which itself re-exports docker-management). shared.ts re-exports them.
• Devcontainer runner already delegated to ensureDockerContainerDetailed for container creation — left unchanged.
• Update dispatcher in runners/index.ts and barrel re-exports to point at the new location.
• Rewrite the PRLT-1364 regression test (docker-single-mount-path.test.ts) to:
  • Locate runDocker in docker-management.ts instead of the deleted docker.ts
  • Assert the legacy docker.ts file no longer exists
  • Keep all the original mount-path invariants

Test plan

• pnpm build passes (full TS rebuild)
• Targeted Docker unit tests pass (docker-single-mount-path, runner-docker, runner-shared, docker-spawn-pipeline, regression-prlt1163-readonly-hq-mount, regression-prlt1363-claude-credential-bind-mount, execution-utils, agent-lifecycle-hooks, work-propose, regression-prlt1240-print-mode, pnpm-store-cache, container-resources)
• All runner/devcontainer/spawner/orchestrator unit tests pass
• Two pre-existing failures in docker-credential-mount.test.ts (assertions for legacy CLAUDE_CREDENTIALS_VOLUME in buildContainerMounts — replaced by host bind-mount in PRLT-1363) reproduce on main and are unrelated to this change

🤖 Generated with Claude Code