Keep vendor node settings in the adapter

[SaladDay]

Each node adapter now owns its node-local settings and code. The shared providers package keeps only the generic node path.

Node configuration. {provider, generation, installation_id, core_url, specification, native}. native is opaque JSON that only the selected adapter decodes, strictly. Resources, the image and artifact hashes are read from specification, never copied.

	Before	After
Docker	docker: {host, image, network, seccomp_file, extra_hosts, nested_sandbox}	native: {host, image, network, seccomp_file, extra_hosts, nested_sandbox}
microsandbox	microsandbox: {helper_path, runtime_path, firmware_path, runtime_home, network, runtime_sha256, firmware_sha256, image, cpus, memory_mib, root_disk_mib, environment_disk_mib}	native: {helper_path, runtime_path, firmware_path, runtime_home, network}

A file in the old shape is invalid.

Docker image. image stays node-local: a classic image store names the loaded image by its config digest (image_id), a containerd store by its manifest digest. The check that it equals one of the two now lives in the Docker adapter's decoder.

Protocol (sandbox_provider.go, docs/sandbox-provider.md): NodeConfig, LocalOptions and Built move into the protocol file. BuildLocal takes sandbox.NodeConfig.

Moves.

• providers/docker.go → docker/node.go.
• providers/microsandbox.go and the microsandbox probe → microsandbox/node.go and microsandbox/probe.go; the native artifacts are exported as microsandbox.NodeArtifacts.
• BackendFingerprint and CheckCapacity → the sandbox package.
• providers keeps Load (strict envelope), Build and the registry list.

Deleted. The specification cross-checks (providers/specification.go), the name-based "both objects" check, and the installer's mirror and stale-key checks.

Behaviour.

• A malformed native fails at Build instead of Load.
• sameGenerationPlan compares only the Core-visible envelope: preparation may resolve node-local settings, and the adapter validates them when it builds. The Python preparer still requires plan and final to match, except for the Docker image within the release's two digests.
• The generation manager logs a probe failure whenever it changes a generation's state or diagnostic.

Installer. provider_config, node_spec, node_generations and remove_node_files write and read native.

Docs (en and zh): configuration.md#docker-node-configuration, getting-started/nodes.md (manual registration) and sandbox-provider.md.

Checks:

• go build, go vet and gofmt.
• sandbox/... and cmd/sandbox-node.
• Dependent packages: cmd/server, api, deployment, placement, execution, deploymentpg, modelconfigurationpg, sessionpg and tests/integration against a database.
• Live Docker provider tests with the fixture image.
• deploy/node unittest and pytest, plus py_compile.
• provider-artifacts and specification-contract (no projection change).
• check-names, make check-docs and translations.

Net: non-test −25, test +15, docs +4.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}