fix(daemon): bound Docker event refresh work

[roodboi]

Summary

• ignore known Docker container events such as health-check exec actions that cannot change the cached runtime view, while failing open for unknown actions
• coalesce relevant event bursts with bounded debounce, minimum spacing, and forced immediate reconciliation for intervals and watcher exits
• cache inspect data by container ID for event refreshes, prune removed IDs, and force full inspection at startup and every 30-second reconciliation
• preserve valid Docker inspect output when another requested container disappears concurrently
• expose event, scheduling, duration, and inspect-cache metrics and document the behavior

Verification

• bun run typecheck
• bun run check
• bun run build
• 18 focused daemon/runtime tests passed, including a 200-event storm, forced interval upgrade, container replacement/pruning, unchanged-ID cache reuse, refresh failure recovery, and partial inspect output
• full unit suite: 933 passed and 5 skipped; 12 sandbox-only registry-lock failures passed when rerun under an isolated HACK_HOME
• live read-only Docker cache check: startup inspected 265 IDs, the unchanged event refresh inspected 0 IDs with 265 cache hits, and the interval refresh forced all 265 IDs
• replayed five minutes of Docker events: all 244 health-check exec events were ignored and no relevant events were misclassified

The daemon lifecycle test requires process-table access and exposes a pre-existing process-global orphan-detection behavior even with an isolated HACK_HOME. The installed launchd daemon was restored, and changed behavior is covered without relying on that unsafe lifecycle path.

Correctness and rollback

Unknown Docker event actions still request refreshes. Startup, watcher exit, runtime repair, and the 30-second interval force full inspection, preserving recovery from missed events and mutable network state. HACK_DAEMON_DISABLE_DOCKER_EVENTS remains the emergency fallback while interval reconciliation continues.

Release signal

Yes. This is a behavior and performance fix and should produce a fix release signal through the Conventional Commit and PR title. This repository does not use a separate changeset artifact for this release path.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cff0e5b93d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b8d0b6789b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".