fix: harden docker context selection checks

[omkhar]

Summary

• centralize Docker context health selection in the trusted helper
• make Docker-backed verification scripts share that selection logic
• restore the verify-invariants harness PATH override used by the fake Docker context test

Testing

• bash -n scripts/container-smoke.sh scripts/generate-builder-environment-manifest.sh scripts/lib/trusted-docker-client.sh scripts/verify-invariants.sh scripts/verify-release-bundle.sh scripts/verify-reproducible-build.sh
• shellcheck scripts/container-smoke.sh scripts/generate-builder-environment-manifest.sh scripts/lib/trusted-docker-client.sh scripts/verify-invariants.sh scripts/verify-release-bundle.sh scripts/verify-reproducible-build.sh
• ./scripts/validate-repo.sh
• WORKCELL_CONTAINER_SMOKE_DOCKER_CONTEXT=colima ./scripts/container-smoke.sh