Refactor Docker workspaces to consume repo checkout state directly

[christso]

Objective

Refactor Docker-backed workspaces so they consume workspace.repos[].checkout directly, without relying on the deprecated workspace.docker.base_commit compatibility bridge.

Context

Issue #987 introduced base_commit as an operational field for Docker-backed grading, but the cleaner long-term model is backend-agnostic checkout state under workspace.repos[].checkout.

That repo-checkout refactor is now partially in place:

• workspace.repos[].checkout.base_commit is supported
• host workspace materialization and pooling use the repo checkout model
• Docker grading can consume repo checkout targets when they are explicitly mapped into the container
• workspace.docker.base_commit remains only as a compatibility bridge

The remaining gap is that Docker/prebuilt-image workflows still do not have a first-class backend model for mapping repo definitions to container paths. Today that means:

• Docker fallback still needs workspace.docker.base_commit for legacy configs
• prebuilt images may contain repos that are not materialized on the host
• workspace.repos[].path is not yet a fully defined container-path contract
• importer output still uses the deprecated Docker field because the direct repo-checkout path is not fully modeled end-to-end

Problem

workspace.repos[].checkout expresses the desired repo state, but Docker execution still has backend-specific ambiguity:

• Which repo paths are inside the container?
• Are those paths relative to the host workspace or absolute in-container paths?
• How should multi-repo Docker images be modeled?
• How should Docker behave when the image has the repo preloaded vs when AgentV materializes the repo itself?

Without a clear backend contract, workspace.docker.base_commit cannot be removed safely.

Proposed Direction

1. Define Docker/backend semantics explicitly.
2. Make Docker grading consume workspace.repos[].checkout as the only checkout source of truth.
3. Introduce an explicit container path strategy for repo entries when Docker is used.
4. Update the SWE-bench importer to emit the repo-checkout model instead of the Docker compatibility field.
5. Remove workspace.docker.base_commit after migration.

Acceptance Criteria

• Docker-backed grading works from workspace.repos[].checkout without requiring workspace.docker.base_commit
• Container repo path mapping is explicitly modeled and documented
• Multi-repo Docker behavior is defined and tested
• SWE-bench/importer-generated evals use the repo-checkout model
• workspace.docker.base_commit is either removed or clearly deprecated with a migration path
• Docs and eval-writer references describe repo checkout as the operational source of truth

Notes

This follow-up is intentionally scoped to the Docker/backend side only. The generic checkout model should remain backend-agnostic.