fix: require finite Docker stats samples

[Joncallim]

Summary

• require the exact finite Bollard stats wire: stream=false&one-shot=true
• reject one-shot=false, streaming, reordered, duplicated, encoded, body, and upgrade variants before raw Docker access
• lock both direct collector and gateway/Bollard wires, and update the owned live fixture probe and authority/deployment/security documentation

Verification

• cargo fmt --manifest-path crates/Cargo.toml --all --check
• cargo test --manifest-path crates/Cargo.toml -p dockermap-docker-gateway (17 passed)
• cargo test --manifest-path crates/Cargo.toml -p dockermap-daemon bollard_wire_contract_for_current_docker_reads (1 passed)
• cargo clippy --manifest-path crates/Cargo.toml -p dockermap-docker-gateway --all-targets -- -D warnings
• git diff --check

npm run typecheck could not start in this isolated worktree because its untracked workspace dependencies are absent (tsc: not found); CI remains the TypeScript validation authority.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-02T17:42:15.188919Z	efe8467	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.