feat: isolate local Docker workloads behind control relays

[adityathakker]

Summary

• add opt-in internal workload networks bridged to Core through an immutable hardened control relay
• validate relay identity, target, hardening, and exact network membership before reuse
• fail closed on mutable relay images, network inspection failures, and legacy published App ports
• safely reprovision ported legacy Apps instead of live-migrating an unsafe endpoint

Verification

• focused config, local sandbox, and Docker deploy tests: 80 passing
• typecheck
• ESLint
• Prettier check
• git diff --check

The relay mode remains opt-in and deployment wiring is intentionally left to consuming deployments.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}