feat(resource): add container infrastructure resource types

Add 7 container infrastructure resource types per ADR-039:
container-runtime, container-image, container-mount, container-exec-env,
container-port, container-volume, container-network.

- YAML configs under examples/resource-types/
- Bootstrap registration via _resource_registry_container.py
- Updated container-instance parent_types (container-runtime, container-image)
  and child_types (container-mount, container-exec-env, container-port)
- container-runtime is top-level with auto-discovery rules (scan_depth: 1)
- container-mount/exec-env/port inherit snapshot sandbox from instance
- container-volume is user-addable with snapshot sandbox
- container-network is read-only, no sandbox
- Handler references are forward declarations (ADR-039)
- 33 Behave BDD scenarios, 4 Robot integration tests
- Updated BUILTIN_NAMES, service docstring, CHANGELOG

ISSUES CLOSED: #831

docs/reference/resource_types_builtin.md

@@ -475,3 +475,52 @@ Sandbox: `copy_on_write`.
 
 A hard link (link count > 1). Parent: `fs-directory`. Leaf type.
 Sandbox: `copy_on_write`.
+
+---
+
+# Container Infrastructure Resource Types (#831)
+
+## container-runtime
+
+A container runtime engine (Docker, Podman, containerd, etc.).
+Top-level type with no parents. Children: `container-image`,
+`container-instance`, `container-volume`, `container-network`.
+Auto-discovers from Docker API endpoints and docker-compose files.
+User-addable. Sandbox: `none`.
+
+## container-image
+
+A container image identified by tag and/or digest.
+Parent: `container-runtime`. Child: `container-instance`.
+Auto-discovers from Dockerfiles and docker-compose files.
+User-addable. Sandbox: `none`.
+
+## container-mount
+
+A bind mount or volume mount inside a container instance.
+Parent: `container-instance`. Children: `fs-directory`, `fs-file`.
+Not user-addable (auto-discovered). Sandbox: `snapshot`.
+
+## container-exec-env
+
+Execution environment variables and configuration inside a container.
+Parent: `container-instance`. Leaf type.
+Not user-addable. Sandbox: `snapshot`.
+
+## container-port
+
+A port mapping between host and container (e.g. 8080:80/tcp).
+Parent: `container-instance`. Leaf type.
+Not user-addable. Sandbox: `snapshot`.
+
+## container-volume
+
+A named container volume managed by the runtime engine.
+Parent: `container-runtime`. Child: `fs-directory`.
+User-addable. Sandbox: `snapshot`.
+
+## container-network
+
+A container network (bridge, host, overlay, macvlan, or none).
+Parent: `container-runtime`. Leaf type.
+Not user-addable. Sandbox: `none`.