[Improve] Structured boot error codes and Docker spawn preflight

[daniel-lxs]

What changed

Follow-up to #544, which mapped Docker boot failures to friendly copy by pattern-matching error prose. This PR makes boot failures first-class instead:

• Preflight before any sandbox resources are created: the Docker provider now checks that the daemon responds and that the worker image is available locally (pulling explicitly when a registry hosts it). The most common self-host failures now fail instantly with a precise reason instead of after a 60s start wait.
• Machine-readable error_code on task_runs (additive column): the controller raises DockerBootError at the sites that know the category (preflight, release-archive checks, worker start assertions with fetch failed log classification), with a controller-side regex classifier as fallback for untyped docker failures.
• The web startup UI maps the persisted code to copy directly; text inference remains only for runs that failed before codes existed. Unknown codes from newer/older releases are ignored safely.
• Drift telemetry: a docker spawn failure that matches no category logs a warning, so the classifiers can't silently rot.
• Docs: the Docker sandbox provider page now maps each boot-failure message to its fix.

Why this change was made

#544 explained failures after the fact by reverse-engineering prose with seven regexes — brittle against Docker error-string drift, and invisible in telemetry. The controller knows which failure happened at throw time; persisting that category makes failure classes countable and the UI mapping exact. Preflight converts boot-then-fail into fail-fast for the cases operators hit most (daemon down, missing image).

Impact

• Self-host boot failures surface instantly with precise, actionable copy.
• Failure categories are now queryable (task_runs.error_code) for support and telemetry.
• Schema change is additive only (N-1 rollback safe).
• Old failed runs keep working via the text-inference fallback.

Validation

• 74 controller + 10 web + 54 sdk finish-run tests pass, including new coverage for preflight, classification, code persistence, and code-preferred display mapping
• pnpm lint:fast, pnpm check-types:fast, pnpm knip all green

🤖 Generated with Claude Code

[roomote-roomote]

No code issues found. See task

• apps/web/src/lib/task-run-errors.ts:117 Unknown persisted codes such as toString pass the in check through Object.prototype, yielding a function instead of display copy; the subsequent friendly.includes(...) call throws and crashes the failure UI. Use an own-property check so unknown codes fall back safely.

_{Reviewed d002a8c}