Sweep leftover path identity probe containers in startup recovery #181

Follow-up from the review of #180.

Problem

At startup the runner probes task storage's path identity with probeTaskStoragePathIdentity (agents/container/storage.ts). This runs a docker run --rm container named codeboost-path-identity-<uuid> on an anonymous tmpfs volume. When the probe fails, it removes that container by name and confirms the removal with container inspect through a 10 s settle window.

Two cases can still leave a created, never-started container and its volume:

• a create that reaches the daemon after the settle window;
• a runner that dies (SIGKILL, a second Ctrl+C) after the client is killed but before the removal.

The probe carries no labels, so startup recovery (agents/recovery.ts, which lists by label) never finds it. The container stays until a person removes it with docker ps -a --filter name=codeboost-path-identity-. It runs no process and its unmounted tmpfs volume holds no memory, so the cost is clutter, not resources.

Proposal

Label the probe with the database's runner owner token. Recovery then sweeps containers with that token and the probe kind, under the runner lock. Only one runner holds a given token at a time, so the sweep cannot remove another runner's probe while it runs.

Today's owner labels (agents/labels.ts) require attempt and allocation IDs, which the probe does not have. The work therefore includes a label shape for runner-scoped objects, plus the matching recovery filter and ownership check.

Acceptance

• A probe container left by a killed runner is removed by the next startup's recovery, together with its anonymous volume.
• The sweep removes nothing labelled with another runner token, and nothing without the probe kind label.
• Tests for both, against real Docker in the Docker-backed suite.