[deploy-plugin DPB-20] deploy-container: OCI build/push + ContainerBuildPort + Dockerfile emission

[rickylabs]

Part of #892 (RFC #891; corpus .llm/runs/plan-deploy-plugin--seed/ r5).

ContainerBuildPort implementation: Dockerfile generation from the EmittedArtifactManifest (denoland/deno:2 base), build/push via docker/podman, registry auth; the small generic container-platform port (create/deploy service, env, logs, status, destroy over REST). Anti-scope: no platform clients here; the implementation is injected into the cloudflare/aws lanes — never imported across adapters (DP-3 §4, SF-11).

Acceptance

• gate: emitted Dockerfile goldens
• gate: image digest recorded in the artifact manifest and verified by up --prebuilt

Metadata

Dependencies: DPB-5
Delivery shape: new adapter (injectable shared OCI path)