feat(container): per-user Docker sandbox + mapped per-user filesystem

Realizes blueprint §6: each user gets a permanent Docker container
(skald-{userid}, our own skald-runtime image with python+node) as their
execution sandbox. Docker is now a hard requirement — a missing daemon fails
Skald::new and the process exits at boot.

- ContainerManager (crates/skald-core/src/container/): docker availability
  check, builds skald-runtime from the embedded Dockerfile, reconciles one
  running container per active user at boot, stops them at shutdown, and
  ensure/remove on user create/delete. Shells the docker CLI (no client crate).
- UserFs (core-api): pure value type carried in ToolContext, mapping the agent's
  single namespace — ~/ → homes/{userid}, shared/{X}/ → shared/{X} (membership),
  user-memory/ + shared-memory/ → SQLite — to host and container paths.
- execute_cmd now runs inside the caller's container via `docker exec`.
- fs-tools resolve every physical path through UserFs to the per-user host
  workspace, host-side, with fail-closed symlink/`..` containment
  (resolve_host_path: canonicalize + prefix-check). grep_files resolves its root
  the same way but stays disk-only.
- shared_folders + shared_folder_members (registry, junction table with
  can_write) back the shared-folder membership that drives both the container
  mounts and the shared/{X} routing.
- Threading: UserContext.fs → ChatSessionManager → handler → ToolContext.fs.

Per-user MCP servers do not yet run in the container (next round).

crates/core-api/src/tool.rs

@@ -50,6 +50,10 @@ pub struct ToolContext {
     /// The owner's unlocked database pool (per-user in multi-user mode; the shared
     /// `system.db` in the transitional single-pool state).
     pub pool: Arc<sqlx::SqlitePool>,
+    /// The caller's filesystem view (blueprint §6): private home + shared folders +
+    /// the container they resolve into. `execute_cmd` execs into `fs.container_name`
+    /// and the disk fs-tools resolve physical paths against `fs`'s host bases.
+    pub fs: Arc<crate::user_fs::UserFs>,
 }
 
 // ── Tool trait ────────────────────────────────────────────────────────────────