feat: add Docker network isolation options

[konard]

Fixes #154.

Summary

• Add Docker-only --network <name> / --network=<name> parsing and repeatable --network-alias support in JavaScript and Rust.
• Emit network arguments in stable order before the image for attached and detached docker run commands, so child commands cannot race network attachment.
• Include the selected network and aliases in human-readable isolation status and execution-record metadata.
• Remove newly created containers left in Docker state created after launch errors such as a missing network, while preserving containers that existed before launch.
• Add JS changeset and Rust changelog fragments for minor releases.

Reproduction

Before this change:

docker network create --internal hive-formal-ai
$ --isolated docker --image alpine:3.23 --network hive-formal-ai -- echo ok

failed with Error: Unknown wrapper option: --network.

Verification

The new real-daemon tests create an internal network and an aliased sidecar. A detached task on that network resolves the alias and exits 0, while an unconnected control cannot resolve it. They also verify that missing-network failures leave no orphan and that a name conflict never deletes a pre-existing container.

• cd js && bun run test — 712 passed
• cargo test --manifest-path rust/Cargo.toml --all-features --verbose
• cd js && bun run lint && bun run format:check && bun run check:file-size
• cargo fmt --manifest-path rust/Cargo.toml --all -- --check
• cargo clippy --manifest-path rust/Cargo.toml --all-targets --all-features
• node scripts/check-test-parity.mjs
• node scripts/check-doc-examples.mjs --implementation js
• node scripts/check-doc-examples.mjs --implementation rust
• cd js && bunx changeset status --since=origin/main

Screenshots are not applicable because this changes CLI and Docker runtime behavior.

[konard]

Working session summary

Implemented and finalized PR #155.

• Added --network and repeatable --network-alias support in JavaScript and Rust.
• Added status and execution metadata.
• Prevented detached startup races by configuring networking in docker run.
• Cleaned up containers created by missing-network failures without deleting pre-existing containers.
• Added parser, runtime, metadata, and real-Docker integration tests.
• Added JS/Rust release fragments.
• Updated PR title/description and marked it ready for review.
• Final SHA: 0030a13
• JavaScript and Rust CI: fully passing across Linux, macOS, and Windows.
• Worktree is clean; PR is mergeable.

---

This summary was automatically extracted from the AI working session output.

[konard]

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

• Model: GPT-5.6 Sol
• Provider: OpenAI
• Public pricing estimate: $17.205875

📊 Context and tokens usage:

• 332.1K / 200K (166%) input tokens, 45.4K / 128K (35%) output tokens

Total: (332.1K + 11.8M cached) input tokens, 45.4K output tokens, $17.205875 cost

🤖 Models used:

• Tool: OpenAI Codex
• Requested: gpt-5.6-sol
• Thinking level: medium (~15999 tokens)
• Model: GPT 5.6 Sol (gpt-5.6-sol)

📎 Log file uploaded as Gist (4662KB)

• View complete solution draft log

---

Now working session is ended, feel free to review and add any feedback on the solution draft.

[konard]

🎉 Auto-merged

This pull request has been automatically merged by hive-mind.

• All CI checks have passed

---

Auto-merged by hive-mind with --auto-merge flag