Harden Docker Sandboxes lifecycle recovery

[joecklau]

Summary

• Harden Docker Sandboxes control-plane recovery for create-time admission failures reported by the known failed to run sandbox container signature.
• Use the explicit stop, authoritative stopped-state confirmation, quiescence, sanitized detached start, running-state confirmation, and stable-inventory sequence.
• Keep exclusive-auto as the default, keep observe non-mutating, and prevent admission incidents from causing repeated daemon restarts through later inventory failures.
• Remove only exact empty staging directories after immediate create failure and update operator/security documentation.

Validation

• go test ./...
• go test -race ./internal/provider/dockersandboxes ./internal/pool
• go vet ./...
• git diff --check

The full test suite passed with test temporary files redirected away from macOS /var path redirection. No sbx reset or sbx logout behavior was added.