TOOLS-138: Package Gateway for Docker

[averycrespi]

Context

Deliver TOOLS-138 as a stacked PR on avery/tools-137-private-http-mcp (#167), not main. Incremental creation base: b214c6c090dfad2f5d3632a86402da7136f763db. Existing unmerged dependencies remain separate PRs.

Provide a fresh-install Docker path behind an existing operator-owned HTTPS proxy. No registry image publication, deployment, network/Tailscale setup, migration/import, or live-service qualification.

Changes

• Digest-pinned staged image build, deny-default context, embedded frontend and CA roots; non-root UID 10001 with direct foreground signal delivery and no implicit initialization.
• Standalone Compose service with complete external installation volume, configurable origin/listeners, separate forward-proxy publication, readiness check and 30-second stop grace.
• Fresh-install guide for custody, secure admin/agent handoff, local CLI, derived stdio images, private HTTP/OAuth, existing proxy contract, maintenance and upgrades.
• Blocking Gateway Docker smoke CI owner: build, explicit init, fail-closed empty/unsafe mounts, start/readiness/local CLI, clean stop and bounded owned cleanup. Classifier/Required tests preserve stacked-target applicability.

Review Notes

Independent pre-publication review is complete with no material findings after correcting the check-evidence inventory; full original review and confirmation are retained. Review the incremental diff from the creation base; source checks exercise the cumulative tree. No authored UI or generated assets changed. Only the documentation ownership manifest/count changed in Go.

Docker is unavailable in the coding environment and was not accessed locally. All 17 required checks passed in CI run 38336744088, including the actual Docker smoke, against source 976d3244006b23e3e6a8a899fdaee8ac82fc5f21 and this PR's actual stacked target. The CI merge tree equals the source tree. TOOLS-139 owns later full cross-protocol/lifecycle/security container qualification. Container CI does not qualify a live Debian host, installed reverse proxy or real provider.

Test Plan

• make test-ci: 49 deterministic tests passed without Docker.
• npm run format:check, make -C agent-gateway verify, normal commit hooks: passed.
• Cumulative unit, harness, material, demo, E2E and security owners: passed.
• Cumulative integration selectors: all first-batch packages passed; the local aggregate reached its shared 15-minute deadline before the remaining batch. That exact disjoint planner batch then passed separately. This is complete test coverage, not a passing aggregate deadline or release acceptance; CI shards remain mandatory.
• go -C agent-gateway tool govulncheck ./..., npm run ui:audit: no vulnerabilities.
• npm run ui:verify-generated and npm run ui:verify-supply-chain: passed. Initial generated verification found checkout-only 0664 modes; the four assets were normalized to 0644 without content changes before passing.
• Initial documentation count mismatch corrected and full unit owner rerun successfully; original failed evidence retained.
• Outgoing-history and exact PR metadata secret scans: passed without findings.
• Exact-head CI: all 17 checks passed, including blocking Docker build/init/start/readiness/clean-stop/cleanup and Required; no reruns or CI repairs.
• CI Quality: Node foundations 187 passed with no skips; frontend typecheck passed. Frontend browser: 31 passed.
• Positive named TestProxyIPv6SocketFallback pass verified in Linux integration-2 job 115098476371.
• Independent full incremental review plus focused evidence-inventory confirmation: complete, no material findings. Original failed local evidence remains disclosed above.