fix(vm-driver): find Docker Desktop's socket when looking up local images

[shiju-nv]

Summary

The MicroVM driver looks for a local container engine through DOCKER_HOST and /var/run/docker.sock only, then Podman. Docker Desktop for macOS can expose just ~/.docker/run/docker.sock, so the driver reports "no local container engine available" and silently pulls the image from a registry. This adds a second lookup step that reuses the Docker driver's existing socket discovery, which already probes Docker Desktop's per-user socket.

Related Issue

Refs #4155. This PR fixes the lookup, which is the first complaint in the issue. The misleading Not authorized outcome and the fallback message are unchanged, so it does not close the issue.

Changes

• connect_local_container_engine now delegates to connect_container_engine, which tries three steps in order: connect_with_local_defaults (kept first because it honours tcp:// and ssh:// DOCKER_HOST values that the Docker driver's discovery does not), then the socket found by openshell_driver_docker::detect_socket, then the Podman socket as before. A failed DOCKER_HOST does not stop the search, in the same way it already did not stop the Podman fallback.
• The two socket detectors are parameters of connect_container_engine so tests can control them without depending on the engines a host runs. Production callers pass the real detectors.
• openshell-driver-vm gains an optional openshell-driver-docker dependency, enabled by its compute-driver feature, beside the existing openshell-driver-podman dependency. It adds no dependency cycle, and the lockfile gains one edge. It also adds the Docker driver library and the toml crate family (toml, toml_edit, toml_datetime, toml_write, serde_spanned, winnow) to the VM driver's build, about ten more entries in its dependency tree. The gateway does not link the VM driver, so the gateway binary is unaffected. If maintainers prefer not to take that cost, the alternative is moving the roughly ten-line candidate list into openshell-core, where the socket probe helper already lives.
• Five unit tests cover the new step, the ordering and the production wiring, using a fake Docker /_ping server on a temporary Unix socket.

Testing

• Checks appropriate to the affected code and behavior pass (locally, below; hosted CI runs on this PR)
• Unit tests added/updated (if applicable)
• E2E tests added/updated (if applicable): none added

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable): not applicable

[drew]

we cannot add a dep on the docker driver to the vm driver

[shiju-nv]

I used the existing openshell-driver-podman dependency as precedent. Docker socket discovery now lives in openshell-core. Should we move Podman discovery there too and remove that driver dependency?