refactor(router): extract worker container launcher

[aaight]

Summary

Issue: https://linear.app/issue/MNG-655

Refactors router worker container lifecycle ownership so container-manager.ts remains the compatibility facade and spawn orchestration layer, while Docker create/start/wait wiring moves into a focused launcher module.

Changes

• Added src/router/worker-container-launcher.ts for Docker worker create/start config, active-worker registration, router timeout timer setup, and async container.wait() handling.
• Reduced src/router/container-manager.ts to job metadata/env assembly, spawn settings resolution, snapshot fallback coordination, shutdown detach behavior, and compatibility re-exports.
• Added direct launcher unit coverage for Docker config/labels, AutoRemove behavior, timeout kill capture, successful wait delegation, and wait-error cleanup.
• Updated architecture docs to distinguish worker-manager.ts BullMQ orchestration from container-manager.ts and helper modules as Docker lifecycle internals.

Behavior preserved

• Docker create config still preserves worker image, env, memory/swap, network, AutoRemove, and cascade labels including router instance, project id, agent type, and snapshot enabled.
• Snapshot-image 404 fallback remains coordinated from spawnWorker: stale snapshot metadata is invalidated, fallback retries once with the base image, fallback failures are captured with source=worker_spawn_fallback, and base-image 404s remain terminal.
• Existing public exports from container-manager.ts are preserved, with launcher types/functions re-exported for compatibility during the facade phase.

Verification

• npx vitest run --project unit-api tests/unit/router/worker-container-launcher.test.ts tests/unit/router/container-manager.test.ts tests/unit/router/snapshot-integration.test.ts tests/unit/router/worker-timeouts.test.ts tests/unit/router/worker-exit-handler.test.ts tests/unit/router/worker-spawn-settings.test.ts tests/unit/router/worker-snapshots.test.ts
• npm run typecheck
• npm run lint:fix
• npm run lint (passes with existing warning-level findings outside this change)
• npm test
• npx vitest run --project integration tests/integration/router/dispatch-retry.test.ts

🕵️ codex · gpt-5.5 · run details

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[nhopeatall]

LGTM - the extraction keeps container-manager.ts as the spawn/fallback facade while moving the Docker create/start/wait path into worker-container-launcher.ts without changing the launch config, labels, timeout path, active-worker tracking, or snapshot cleanup behavior.

Verified locally: npx vitest run --project unit-api tests/unit/router/worker-container-launcher.test.ts tests/unit/router/container-manager.test.ts tests/unit/router/snapshot-integration.test.ts (74 tests passed).

🕵️ codex · gpt-5.5 · run details