Deliver tong secrets over docker exec stdin

[CrypticSwarm]

Secret delivery to tongs relied on a host FIFO bind-mounted into the container, which breaks under Docker Desktop: containers run in a VM, and virtiofs shares file data across that boundary, not kernel pipe semantics. Delivery therefore only worked on native Linux.

The rendezvous now lives inside the container. The tong's /bin/sh wrapper creates the FIFO itself on a launcher-mounted tmpfs at /run/swarmforge, and the launcher streams the export script through docker exec -i ... cat > <fifo> on stdin. Every hop — the exec stream, the tmpfs, the FIFO — is served by the container's own kernel, so the transport behaves the same on Linux, macOS, and Windows.

Properties preserved:

• The secret never appears in docker inspect (container or exec instance), an argv, or a file; the bytes live only in docker's API stream and the container kernel's pipe buffer.
• The FIFO handshake still synchronizes startup: the wrapper blocks reading, the writer blocks until the read side opens, EOF marks the payload complete, so the real process never starts without its full secret env.
• Failures still tear down the half-configured container, and fatal delivery errors now carry docker's own stderr, distinguishing a crashed tong from a daemon problem.

The deliver script guards with [ -p ] and a reserved retry exit code so a too-early cat cannot leave the secret in a regular file. Tmpfs options are pinned (mode=1777) so a non-root image user can mkfifo regardless of what the engine would inherit. Because the tmpfs occupies all of /run/swarmforge, a secret-bearing tong's mounts are now refused anywhere under that directory, not just on the FIFO path (second commit).

Contract change: a secret-bearing tong's image needs mkfifo and rm alongside /bin/sh and cat. The host-side FIFO machinery (temp dir, uid chown, image-user lookup) is gone — the exec runs as the same user as the wrapper.

Tested with the full unit suite (533 tests), including a real-shell round-trip of the wrapper and deliver scripts against an actual FIFO, a 100KB payload exceeding the pipe buffer, and the premature-delivery guard. The docker transport itself (exec stdin EOF through Docker Desktop's VM proxy) still needs a smoke test on a real Mac: launching any secret-bearing tong exercises it end to end.