Default own-machine sandboxes to microsandbox and confirm Docker

[SaladDay]

Makes microsandbox the default self-hosted sandbox backend in the setup wizard. The product owner decided this; the backend's installer changes its --sandbox default to match.

Changes

• Own machines now preselects microsandbox, shown first with a neutral Recommended label. A saved Docker or microsandbox deployment stays selected.
• Choosing Docker opens a confirmation dialog, "Use Docker instead of microsandbox?", with three points:
  • Weaker isolation: containers share the host's kernel, so a container escape reaches the host; microsandbox runs each sandbox in its own microVM.
  • Root-equivalent access: the node's service account joins the docker group, which is root-equivalent on that host.
  • Limited use: only for trusted workloads, or hosts without KVM.
• In the dialog, Keep microsandbox is the primary action and has focus; Use Docker is secondary. Cancel, ×, Escape or an outside click all keep microsandbox.
• Once confirmed, the dialog isn't asked again in the same wizard session. A deployment that already runs Docker isn't asked when changing resources.
• The shared Modal gains an optional initialFocus. Other dialogs are unchanged.
• The wizard help tips now say microsandbox is recommended.
• DESIGN.md and PRODUCT.md are updated. docs/web needs no change: no line there states a default.

Tests

• The existing wizard e2e now goes through the default microsandbox path.
• A new e2e covers the Docker dialog: cancel keeps microsandbox, confirm selects Docker, and it isn't asked again.
• typecheck ✓, web tests 366, build ✓, full web e2e 35/35.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}