Covers the Docker runner against a real daemon (the whole suite skips when none is reachable): container workspaces isolated from the host, escape rejection, real commands with exit codes and timeouts, a background server actually served through the mapped preview port, and container removal on dispose.

## Before writing SPEC.md files

Read https://raw.githubusercontent.com/brillout/sdd/refs/heads/main/sdd.md
