ca-sandbox 0.1.3: single docker primitive + helper-container hardening

Sandbox-driver consolidation and hardening, from the tribunal remediation. ca-sandbox is the sibling infrastructure plugin to ca and versions independently (ADR-0007); it remains a Feature Forge preview.

Changed

• One shared docker primitive (#180). tools/docker.ts is now the single module every docker invocation flows through, replacing duplicated spawn/argv logic across build/run/exec/cp/create/registry/claude-inside — so the argv-array discipline (no shell: true) and the container-hardening flags cannot drift between call sites.

Fixed

• Helper containers are labeled and time-bound (#173). The transient helper containers the driver spawns now carry an identifying label and a bounded lifetime, so an interrupted run cannot leak an unlabeled, unbounded container.

Also includes 0.1.2 (the ca-sandbox portion of the tribunal quick-kills, #197): atomic provenance/state writes, typed docker spawn options (shell omitted), dead re-bind cleanup, and fail-closed CI scripts. Full detail in the ca-sandbox CHANGELOG.