LEA-276: Clean operation-owned Docker resources

[Yacobolo]

Summary

• persist an immutable Docker resource baseline before admission
• remove operation-created Swarm services, detached/Testcontainers containers, networks, and volumes before FIFO release
• protect pre-existing Autback and Docker/Swarm infrastructure
• retry partial cleanup and daemon outages from durable state
• exercise the real Docker lifecycle, including crashed Ryuk behavior and nested services

Stack

Depends on LEA-278. No Docker-in-Docker is introduced.

Verification

• task test
• go test -race ./...
• go vet ./...
• CI real-Docker integration test

Linear: https://linear.app/leapstack/issue/LEA-276