Fix worker image missing docker CLI; harden spawn-failure handling

Root cause of the prod empty-response: the spoon-agent-worker image shipped
without a docker CLI binary, so it could never launch the codex job container.
On Debian trixie (the bun base) 'docker.io' + --no-install-recommends installs
the daemon package but omits the client (split into 'docker-cli'), leaving no
'docker' on PATH. execa('docker', ...) hit ENOENT, and with reject:false that
resolves with exitCode undefined -> coerced to 0 -> looked like a successful
empty run -> 'Codex completed without producing an assistant response'.

- agent-worker.Dockerfile: drop docker.io, install the official static docker
  CLI client pinned to 29.5.3 (matches the host daemon) to /usr/local/bin/docker
- runtime/docker.ts: normalizeRunResult() so a spawn failure (exitCode null) is
  always a non-zero exit carrying the real reason, never a silent empty success
- tests: cover the spawn-failure and normal-result paths

docker/agent-worker.Dockerfile

@@ -11,12 +11,24 @@ RUN apt-get update \
     bash \
     ca-certificates \
     curl \
-    docker.io \
     git \
     jq \
     openssh-client \
   && rm -rf /var/lib/apt/lists/*
 
+# Docker CLI client only — the daemon is the host's, reached via the bind-mounted
+# /var/run/docker.sock. The Debian `docker.io` package does NOT install the
+# client under `--no-install-recommends` (trixie split it into `docker-cli`),
+# which left the worker with no `docker` binary and silently broke every job.
+# Install the official static client pinned to the host daemon's version.
+ARG DOCKER_CLI_VERSION=29.5.3
+RUN arch="$(uname -m)" \
+  && curl -fsSL "https://download.docker.com/linux/static/stable/${arch}/docker-${DOCKER_CLI_VERSION}.tgz" -o /tmp/docker.tgz \
+  && tar -xzf /tmp/docker.tgz -C /tmp \
+  && install -m0755 /tmp/docker/docker /usr/local/bin/docker \
+  && rm -rf /tmp/docker /tmp/docker.tgz \
+  && docker --version
+
 WORKDIR /app
 
 COPY package.json bun.lock* turbo.json ./