feat(delivery): docker sandbox adapter + owner-only infrastructure (v2 phase A3-1)

The execution boundary for v2. Adds the local docker/podman sandbox adapter
and the hardened host subprocess runner every other delivery adapter will use.

- adapters/process.py: the one place the platform shells out. argv-only (no
  shell), start_new_session + killpg on timeout, concurrent stdout/stderr
  drains with a byte cap, explicit minimal env (never os.environ), and a
  missing binary reported as spawn_failed rather than an exception.
- adapters/docker_sandbox.py: DockerSandboxAdapter over SandboxProviderPort.
  --user 1000:1000, --cap-drop ALL, no-new-privileges, pids/cpu/memory limits,
  --read-only with tmpfs scratch, one bind mount (the work tree, never the git
  dir), labels, no published ports. Path-safe file access; secrets refused in
  `docker exec -e`. Extras for later phases: start_demo_container (loopback
  publish only), list_managed_containers, remove_container.
- registry: SANDBOX_PROVIDER=docker, cached singleton so the workspace registry
  survives create_workspace -> start_session.
- sandbox_gateway worker: reap_orphans() removes labelled containers no live
  session points at, audited as sandbox.reap; run_pass() does both passes.
- sandbox router: every mutating route now requires the platform owner
  (PLAN-v2 §7.7); read-only status routes stay open to org members.
- sandbox-panel: canManageInfra prop (fails closed) hides the create form,
  the session panel and the action buttons from non-owners.

Tests: 346 API (+37), 67 web (+3); ruff, mypy, tsc and lint clean.
Three existing tests now drive the sandbox as the platform owner, since that
is who may touch it.

Report: docs/plan/reports/agent-3-phase-1.md

apps/api/app/infrastructure/adapters/registry.py

@@ -89,6 +89,13 @@ def get_sandbox_provider():
     provider = settings.sandbox_provider.lower()
     if provider == "mock":
         return mock.LocalMockSandboxAdapter(max_output_bytes=settings.sandbox_max_output_bytes)
+    if provider == "docker":
+        # Local docker/podman. One instance per process so the workspace
+        # registry (external id → host dir) stays consistent between
+        # ``create_workspace`` and the ``start_session`` that follows it.
+        from app.infrastructure.adapters.docker_sandbox import DockerSandboxAdapter
+
+        return DockerSandboxAdapter()
     if provider in {"daytona", "e2b"}:
         from app.infrastructure.adapters.sandbox_remote import build_remote_sandbox_adapter
 
@@ -99,7 +106,8 @@ def get_sandbox_provider():
             e2b_api_key=settings.e2b_api_key,
         )
     raise ProviderUnavailableError(
-        f"SANDBOX_PROVIDER='{provider}' پشتیبانی نمی‌شود. مقادیر مجاز: mock | daytona | e2b"
+        f"SANDBOX_PROVIDER='{provider}' پشتیبانی نمی‌شود. "
+        "مقادیر مجاز: mock | docker | daytona | e2b"
     )