Retain Docker and Blaxel standby tasks with bounded cleanup

[mrubens]

Summary

• retain local Docker task containers and resume them in place with worker resume
• add provider-specific maximum count and age limits for Docker and Blaxel standby resources
• run a five-minute retention sweep that protects active resumes and evicts expired/oldest resources
• make Blaxel standby TTL follow its configured retention age
• add Docker access to BullMQ in the self-host Docker overlay and expand sleep-check indexes
• document the new retention controls

Defaults

• Docker: 10 retained containers, 24 hours
• Blaxel: 25 retained sandboxes, 168 hours
• setting a provider max count to 0 disables its standby retention

Configuration

• DOCKER_STANDBY_MAX_COUNT
• DOCKER_STANDBY_MAX_AGE_HOURS
• BLAXEL_STANDBY_MAX_COUNT
• BLAXEL_STANDBY_MAX_AGE_HOURS

Validation

• affected package suites: 898 tests passed
• Docker stop/start/destroy smoke test against the local daemon
• Docker sandbox isolation integration suite: 2 tests passed
• test database schema push and generated migration
• self-host Docker Compose overlay validation
• pnpm format:check
• pnpm lint:fast
• pnpm check-types:fast
• pnpm knip

[roomote-roomote]

Both previously flagged issues remain resolved. No new code issues found in the latest changes. See task

Review findings

• 🔴 apps/controller/src/compute-providers/spawn-docker-worker.ts:196 — Egress policy is not re-applied when a Docker standby container resumes. Resolved by the new restoreDockerStandbyNetworking helper (docker-sandbox-security.ts:312), which re-runs attachDockerEgressPolicy (with blockDockerGateway set from controlNetwork) and is invoked on the resume branch after docker start and before the worker is exec'd (spawn-docker-worker.ts:200).

• 🟡 apps/controller/src/compute-providers/spawn-docker-worker.ts:142 — Control-plane trusted-service reconnection is skipped on resume. Resolved: restoreDockerStandbyNetworking now calls connectTrustedControlPlaneServices when controlNetwork is set. That helper is idempotent (skips already-attached services and swallows already-connected errors), so recreated api/preview-proxy containers are reconnected on resume without breaking the common still-attached case.