feat(container): per-user Docker sandbox + mapped per-user filesystem

Realizes blueprint §6: each user gets a permanent Docker container
(skald-{userid}, our own skald-runtime image with python+node) as their
execution sandbox. Docker is now a hard requirement — a missing daemon fails
Skald::new and the process exits at boot.

- ContainerManager (crates/skald-core/src/container/): docker availability
  check, builds skald-runtime from the embedded Dockerfile, reconciles one
  running container per active user at boot, stops them at shutdown, and
  ensure/remove on user create/delete. Shells the docker CLI (no client crate).
- UserFs (core-api): pure value type carried in ToolContext, mapping the agent's
  single namespace — ~/ → homes/{userid}, shared/{X}/ → shared/{X} (membership),
  user-memory/ + shared-memory/ → SQLite — to host and container paths.
- execute_cmd now runs inside the caller's container via `docker exec`.
- fs-tools resolve every physical path through UserFs to the per-user host
  workspace, host-side, with fail-closed symlink/`..` containment
  (resolve_host_path: canonicalize + prefix-check). grep_files resolves its root
  the same way but stays disk-only.
- shared_folders + shared_folder_members (registry, junction table with
  can_write) back the shared-folder membership that drives both the container
  mounts and the shared/{X} routing.
- Threading: UserContext.fs → ChatSessionManager → handler → ToolContext.fs.

Per-user MCP servers do not yet run in the container (next round).

crates/skald-core/src/session/handler/mod.rs

@@ -20,6 +20,7 @@ use crate::config::DatetimeConfig;
 use crate::db::{chat_history, chat_sessions_stack};
 use crate::events::ServerEvent;
 use core_api::message_meta::MessageMetadata;
+use core_api::user_fs::UserFs;
 use crate::llm::LlmManager;
 use crate::mcp::McpManager;
 use crate::image_generate::ImageGeneratorManager;
@@ -268,6 +269,10 @@ pub struct ChatSessionHandler {
     /// The authenticated user who owns this session. Threaded into `ChatOptions`
     /// so the telemetry metadata row in `system.db` carries `user_id`.
     pub(super) user_id:          String,
+    /// The owner's filesystem view (home + shared folders + container), threaded
+    /// into every [`ToolContext`] so disk fs-tools resolve per-user host paths and
+    /// `execute_cmd` execs into the owner's container (blueprint §6).
+    pub(super) fs:               Arc<UserFs>,
     pub(super) llm_manager:      Arc<LlmManager>,
     pub(super) max_history_messages:  usize,
     pub(super) max_tool_rounds:       usize,
@@ -337,6 +342,7 @@ impl ChatSessionHandler {
         db:                    Arc<SqlitePool>,
         shared_pool:           Arc<SqlitePool>,
         user_id:               String,
+        fs:                    Arc<UserFs>,
         llm_manager:           Arc<LlmManager>,
         max_history_messages:  usize,
         max_tool_rounds:       usize,
@@ -363,6 +369,7 @@ impl ChatSessionHandler {
             db,
             shared_pool,
             user_id,
+            fs,
             llm_manager,
             max_history_messages,
             max_tool_rounds,