Fix stale local Docker workers and tunneled live sessions

[mrubens]

Summary

• validate that an existing local worker image contains the networking tools required by Docker egress isolation
• rebuild stale images from the current worker Dockerfile before launching tasks
• route local Docker sandbox-server HTTP and WebSocket traffic through the public app edge so phones and other ngrok clients do not receive a loopback URL
• cover compatible images, stale images, public sandbox routing, and direct fallback behavior with unit tests

Validation

• pnpm exec dotenvx run -f .env.test -- pnpm --filter @roomote/dev exec vitest run src/services/__tests__/docker.test.ts
• pnpm exec dotenvx run -f .env.test -- pnpm --filter @roomote/controller exec vitest run src/compute-providers/__tests__/spawn-docker-worker.test.ts
• pnpm lint:fast
• pnpm check-types:fast
• pnpm knip
• validated and reloaded the local Caddy configuration
• local Docker task run Improve Microsoft Teams setup flow #25 connected through https://openroomote-matt.ngrok.app, including a successful WebSocket upgrade (101), runtime-state request (200), and signed-in Chrome UI showing Idle with no connection error

[roomote-roomote]

No new code issues found. See task

_{Reviewed #bd4d909 at 2026-07-12 02:41:00 UTC}