Remote workrooms on Docker running on another machine #307

🤖 Left by Claude Code, from the eng review of the local-container workrooms plan.

Summary

Let a remote workroom run on a Docker host other than this Mac, for example a home server or another Linux box reached through DOCKER_HOST=ssh://… or a Docker context. Unlike a local container, such a workroom keeps running when the laptop closes, which is the remote headline (docs/designs/remote-workrooms.md:90), and needs no cloud provider.

This would be a Remote entry in the "where to create" submenu, next to boxd and exe.dev, and not a local one.

What it needs

• Reaching sshd. ContainerHostDriver publishes the container's ssh port on 127.0.0.1 only (ContainerHostDriver.swift:316), so on another machine the Mac can't reach it. Options: tunnel through the Docker host's own ssh, or publish on an address the Mac can reach (which re-opens the sshd hardening from workroom-host smoke test: check sshd hardening, and cover arm64 in CI #299).
• Credentials. Remote, so the broker only. No Mac relay, since the Mac isn't always on.
• Target per workroom. Record the Docker host or context on the workroom. This builds on the context pinning planned for local Docker workrooms.
• Base per target. Bases are kept per runtime and context, so a remote Docker host gets its own base.

Depends on

The local-container issue's Docker dialect, context pinning and driver-per-kind routing.

Related: #253, #258, #259, #260.