test: add docker package unit tests

[dennisonbertram]

internal/docker/client.go has zero test coverage. The `docker.Client` interface is now defined — tests can use `testutil.MockDockerClient` to test callers, but the client itself needs tests too.

What to test (without requiring a live Docker daemon):

• `ContainerInfo.HealthStatus` is populated correctly from inspect response (nil Health = empty string)
• `circuitRetryBackoff` returns correct durations for openCount 0, 1, 2, 3+

What requires integration testing (live Docker):

• `RunContainer` with gVisor runtime
• `EnsureNetwork` idempotency
• `VerifyGVisorRuntime`

Tag integration tests with `//go:build integration` and skip in CI by default.