refactor(mcpg): type container runtime arguments and mounts

[jamesadevine]

Context

This refactor is prompted by PR #1824 review thread:

• feat(ado-proxy): add credential-isolated Azure DevOps reads #1824 (comment)

McpgServerConfig is already the dedicated serialized server type, but its mounts: Option<Vec<String>> and args: Option<Vec<String>> still encode Docker mounts/network/add-host/user as untyped positional strings. That obscures the structure and makes it easy to introduce invalid or conflicting runtime settings.

The work should introduce typed container runtime configuration/builders (for example Mount with source/destination/read-only mode, Network mode/name, AddHost, and User) and serialize to MCPG's existing arrays only at the boundary. This should be reused for the Azure DevOps MCP, SafeOutputs, and user MCPs where practical.

Requirements

• Introduce typed container runtime configuration and builders rather than untyped positional strings.
• Serialize to MCPG's existing arrays only at the boundary.
• Reuse the typed configuration for Azure DevOps MCP, SafeOutputs, and user MCPs where possible.
• Preserve the required security invariants:
  • The ADO MCP cannot use host networking.
  • The ADO MCP joins only the internal proxy network.
  • The ADO MCP redirects the protected host to ADO_PROXY_IP.
  • The ADO MCP mounts only the package tree/public CA read-only and never mounts keys/tokens.
  • SafeOutputs remains --network none and uses least-privilege user semantics.
• Reject invalid/conflicting settings structurally rather than at the string boundary.

Acceptance

• Invalid/conflicting settings are rejected structurally.
• No ad-hoc source:dest:mode or paired CLI token construction appears in compiler-owned call sites.
• Serialized MCPG JSON remains unchanged.
• Tests cover ordering, modes, host-network denial, read-only mounts, and security invariants.