test: add bounded offline CPU container validation

[binaryaaron]

What changed and why

Require a local Docker context audit before building and run coverage plus installed e2e with bounded CPU/memory and external networking disabled. Ordinary pytest never invokes Docker. Use fresh per-attempt result directories and retain cleanup diagnostics without masking primary failures.

Stack position: 6/12. Base: codex/usersim-draft-pr05-e2e. Merge in stack order.

How it was verified

At this Make-stage boundary, 110 focused e2e/container tests passed, plus lint, format, lock and documentation checks. Docker calls were mocked in the ordinary test suite.

The latest cleanup used focused checks and independent source review. Earlier full matrix/native/container results retain their original revision; those broad runs and all twelve Arc reviews were not repeated after the cleanup. GitHub CI results are pending.

[github-actions]

Thank you for your submission! We ask that you sign our Developer Certificate of Origin before we can accept your contribution. You can sign the DCO by adding a comment below using this text:

---

I have read the DCO document and I hereby sign the DCO.

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the DCO Assistant Lite bot.}