refactor(sandboxer): promote docker to top-level provider

[dungdm93]

Overview

This PR refactors the container sandboxer architecture:

• Promotes ProviderDocker = "docker" to a first-class sandboxer provider, replacing the legacy container provider and implementation = "docker" field.
• Refactors core/pkg/sandboxer/container into a vendor-agnostic container orchestration library (handling job/service containers, bridge networking, sandbox layouts, and runtime provision bind mounts) without any moby/moby dependencies.
• Introduces core/pkg/sandboxer/docker as the concrete Docker sandboxer provider, configuring the Docker client, telemetry, and delegating to container.New.
• Retains full compatibility for host and incus sandboxers via container.NewBootstrapper.

Changes

• core/config/config.go: Replace ProviderContainer with ProviderDocker, update DefaultConfig.
• core/pkg/sandboxer/container: Remove Docker SDK dependencies and init() provider registration; export DefaultImage, New, NewBootstrapper, NewProvisioner, NewSandbox.
• core/pkg/sandboxer/docker: Add new package registering config.ProviderDocker, defining Config, DefaultConfig, factory, and New.
• Unit tests added/updated in config, sandboxer/container, and sandboxer/docker.
• Architecture design spec and implementation plan added under docs/superpowers/.

Verification

• Verified all unit tests across core/pkg/sandboxer/..., core/config/..., core/..., runner-gha, and runner-gitea using -tags=containers_image_openpgp,exclude_graphdriver_btrfs.