Add experimental WSLC container orchestrator

[Karol Zadora-Przylecki (karolz-ms)]

Summary

Add a native WSLC CLI-backed container orchestrator in internal/wslc, alongside Docker and Podman, and integrate it with the real-runtime conformance infrastructure from #254.

• Implement container, image, network, and volume operations; runtime status/diagnostics; exec, logs, file creation, and PTY attachment.
• Support explicit --container-runtime wslc and deterministic automatic preference: healthy Docker, then Podman, then WSLC.
• Use WSLC's default session without managing its lifetime or changing its configuration.
• Keep ContainerHost() as a string contract; an empty hostName explicitly means a default container-to-host address is unsupported, not that the runtime is unhealthy.

Implementation details

• Normalize WSLC JSON layouts, partial results, requested identifiers, repeated labels with last-value-wins semantics, and full network IDs versus native names, including creation-time attachments and aliases.
• Implement forced disconnect by attempting ordinary disconnect and verifying the result, including stopped-container configuration and exact network identity. Unverifiable outcomes remain errors.
• Reuse shared structured-file archive generation across all three runtimes. Add restricted disk-backed image-layer build contexts for WSLC while preserving Docker/Podman streaming behavior.
• Share bounded, regular-file, strict SHA-256 IID validation between WSLC builds and directory-backed image-layer builds.
• Scope runtime-health error matching to WSLC session/control failures rather than unrelated registry connection failures.
• Cancel network-watch forwarding channels on failed subscriptions and normal teardown.
• Extend conformance and integration coverage for duplicate labels, partial operations, full network IDs, per-runtime terminal behavior, and real V2 stopped-network cleanup.

Why this is a draft

WSLC CLI 2.9.11.0 does not expose native container/network events. Watch methods return explicit unsupported errors; there is no polling substitute or successful no-op subscription. This PR should remain a draft until native CLI events can be wired up and the event-dependent gates removed.

The three intentionally gated WSLC real-runtime cases are:

• TestWatchContainersMethod/wslc
• TestWatchNetworksMethod/wslc
• TestTunnelProxyWithRealOrchestrator/wslc

Non-event conformance, direct PTY attachment, controller-terminal integration, image layers, and V2 network cleanup remain enabled and pass.

CONTRIBUTING.md documents the remaining CLI limitations and adaptations, including build platform selection, non-default restart policy, health-check start interval, IPv6 network creation, raw capability flags, and unsupported default host addressing. Missing CLI exposure does not imply the underlying WSL runtime lacks those capabilities.

Validation

Passed on Windows with Docker 29.7.2 and WSLC 2.9.11.0:

• make test-prereqs
• make compile
• make lint — 0 issues
• Full make test with the true-runtime opt-in disabled
• Full make test with DCP_TEST_ENABLE_TRUE_CONTAINER_ORCHESTRATOR=true and TEST_CONTEXT_TIMEOUT=180 — 85 passing packages
• Native Docker/WSLC create/run with full network IDs and aliases, duplicate-label regression, terminal end-to-end, and V2 stopped-network cleanup

Podman was not installed on the validation machine, so its unit tests ran but real Podman execution was unavailable. The five focused review findings were addressed and re-reviewed before the final full-suite runs.