docs(provider): record guest package verification for Node and Docker CLI #89

Owner decision H50:b (2026-10-16): the Docker CLI and Node binaries are not hash-pinned in the host agent. The contract instead records that guest package verification covers them. Today specs/006-whr-cli/contracts/devcontainer-provider.md §Tools requires the exact installed version and hash, while the code checks only the version string (internal/devcontainer/tools.go, internal/providers/docker/native_open.go). The Node values in tool-pins.json hash release archives, not the binary.

Acceptance criteria

• The contract states that Node and the Docker CLI are verified by version plus guest package verification, and names where that verification happens.
• tool-pins.json labels the Node digests as archive digests, or the contract says so.
• No code change; make check is green.

Found by the independent pilot review on 2026-10-16. Builds on the pilot branch pilot/installable-pilot-pr (split from #83); start from its current head.

🤖 Generated with Claude Code