feat(workspaces): accept Docker runtime journeys

Exercise probe, creation, terminals, file observation, Git, scripts, and agent edits through the Desktop Docker runtime while proving host decoys remain untouched.

Selected-runtime creation has a longer request budget because materialization and setup can legitimately exceed the legacy RPC ceiling; legacy creation keeps its existing timeout. Materializing records remain durable but private until final placement is published.

Scope Docker resources to the daemon owner and validate both container and volume before every lifecycle operation and creation race. Explicit Local and Worktree selection remains behaviorally unchanged, including reusable Local script terminals and the shared common-Git watcher.

Real-provider manual QA uses ignored checkout-local configuration and is intentionally not committed.

.github/workflows/docker.yml

@@ -17,6 +17,7 @@ on:
       - "packages/cli/**"
       - "packages/client/**"
       - "packages/docker-workspace-runtime/**"
+      - "packages/desktop/**"
       - "packages/fixture-workspace-runtime/**"
       - "packages/workspace-runtime-contract/**"
       - "packages/expo-two-way-audio/**"
@@ -175,12 +176,24 @@ jobs:
       - name: Install dependencies
         run: node scripts/npm-retry.mjs ci
 
-      - name: Build server dependencies
-        run: npm run build:server-deps
+      - name: Build server stack
+        run: npm run build:server
+
+      - name: Build Docker acceptance image
+        run: docker build --file packages/docker-workspace-runtime/Dockerfile --tag paseo-workspace-runtime-e2e:test .
 
       - name: Test workspace runtime contract
         run: npm run test:workspace-runtime:docker --workspace=@getpaseo/server
 
+      - name: Install Playwright browser
+        run: npx playwright install chromium
+
+      - name: Test Docker Desktop acceptance journey
+        run: npm run test:e2e:renderer --workspace=@getpaseo/desktop -- e2e/new-workspace-docker.spec.ts --workers=1
+        env:
+          E2E_DOCKER_ACCEPTANCE: "1"
+          E2E_DOCKER_WORKSPACE_IMAGE: paseo-workspace-runtime-e2e:test
+
   publish:
     needs: setup
     if: needs.setup.outputs.publish == 'true'