feat: run the Docker driver as a launched external driver by default #5389

Part of #5200.

User Story

As an OpenShell Maintainer I want the desktop drivers to exist in their own repository so that their ownership and maintenance can be considered separately to core OpenShell. Docker has to run as a separate process first.

Problem Statement

The Docker driver is compiled into the gateway binary. CI runs it as an external driver (docker-external-driver-e2e), but only as an operator-managed process that does not go through the launcher, and the additional-CA e2e refuses to run with an external driver.

Impact / Why This Matters

Moving Docker to a separate repository requires that a default install launches it as an external process without losing features.

Proposed Design

Build openshell-driver-docker as a standalone binary on the new contract and make it the default, keeping the linked-factory feature for one release as a fallback. The driver validates its own config. Driver names, auto-detect order, and config tables are unchanged.

Acceptance Criteria

• Existing Docker e2e suites pass on the external path.
• docker-additional-ca-e2e passes against the launched driver, and the wrapper script's "in-process only" guard is removed.
• Create and streaming latency are recorded against the linked path.
• Driver names, auto-detect order, and config tables work as before.

Alternatives Considered

• Keep Docker linked until it moves. Defers the work, but the move itself then needs the launcher and the behavior change at once.

Agent Investigation

• e2e/with-docker-gateway.sh exits with an error if the additional-CA mode is combined with OPENSHELL_E2E_EXTERNAL_COMPUTE_DRIVER.