TOOLS-139: qualify Docker protocols and lifecycle in CI

[averycrespi]

Context

TOOLS-139 qualifies Gateway's Docker deployment across protocols and lifecycle boundaries. Stacked on #168 (avery/tools-138-docker-packaging), not main.

Changes

• Extend the serial Docker owner with real HTTPS proxy/Chromium, MCP stdio/private HTTP/external-style HTTPS, deterministic OAuth, HTTP/HTTPS forwarding and native Git fixtures.
• Cover trust and credential roles, address/Origin denials, one-shot uncertainty, non-root custody, replacement persistence, graceful drain, stopped maintenance and forced-stop recovery diagnostics. Use disposable isolated resources and an identical-binary derived stdio fixture.
• Make container qualification block Required on stacked targets and upload sanitized revision/image/case/cleanup evidence.
• Add bounded catalog-local audit admission handling for proven pre-mutation refusal: four acquisitions, unchanged prepared evidence and cancellation-resistant first settlement. Never replay traversal, external work, publication or uncertain writes; preserve polling, security policies and qualification timeouts. Add source-owned diagnostic stages and native regression coverage.

Review Notes

Independent source reviews are complete; the final audit-admission review found no material issues. Qualification is bound to head 72b125e46e97b395d633d084866b3181bd5795b8, base 976d3244006b23e3e6a8a899fdaee8ac82fc5f21, and tested merge checkout f78af0cc76ac0f960e1f7adbf2fce81aa80c8b51.

The actual Docker report passes all 13 cases, packaging and cleanup. Earlier failed runs remain historical failures; the observed audit refusal does not identify their competing writer or establish every historical cause.

Commit 4a793a72 inadvertently selected the wrong hook directory. Before publication, all ten changed files passed the configured lint-staged tasks without byte changes, and 72b125e4 ran the normal pre-commit/lint hook as an empty bookkeeping commit. No history was rewritten.

No local Docker execution, registry publication, merge or deployment. Evidence is Linux/amd64 container qualification, not live Debian/provider/installed-proxy adoption, other architectures or physical power-loss durability.

Test Plan

• Passed: CI run 38382583254, attempt 1, all 17 required owners including Required, Linux/macOS integration and demos, browser, E2E, lint and vulnerability scan.
• Passed: actual Docker qualification artifact: 13 cases, packaging and cleanup; verified artifact SHA256 85a96a9c577e78cef80f89937141b9ee43c8052d31a57b98ccfff4762b49dd2c. Shipped image sha256:b60574b5c61e5cf1eb9269a90af1e4327258980e314c58a7863215ff09ad5b57.
• Passed independently in hosted logs: named TestProxyIPv6SocketFallback, 187 frontend Node tests (zero skipped), frontend typecheck, make fmt-check, and 31 browser tests.
• Passed locally: make test-ci (79 tests), Gateway verify, test-unit, test-harness; race-enabled catalog/contract and storage-fault tests; four native lifecycle/no-replay regressions; formatting, 69 relative documentation links and full cumulative patch/history secret scans.