feat: add Docker execution mode

[RobertTLange]

What changed

• Add --docker execution for one-shot agent runs using ghcr.io/RobertTLange/headless:latest by default.
• Mount workdirs and agent seed config safely, with a writable ephemeral container home.
• Add headless docker doctor and explicit headless docker build for local/npx-friendly image workflows.
• Package the Dockerfile and document the Docker workflow.

Why

Docker mode should be smooth for normal use without surprising users with automatic local image builds. Plain --docker lets Docker pull the default image; local builds are explicit.

How to test

• npm run check
• npm run pack:check
• headless docker doctor
• headless docker build --print-command
• headless codex --prompt "Reply exactly: docker-ok" --docker --docker-image headless-local:dev