Edit a container's /etc/hosts through its host-side file instead of docker exec

[GyulyVGC]

docker exec refuses on a paused container, so the exec-based hosts edits
silently skipped exactly the containers that most needed them: a teardown
racing the docker pause that follows it left the entry behind, pointing at
an overlay IP whose tunnel was just deleted. Nullnet resumes with unpause,
which does not regenerate /etc/hosts, so it survived.

Setup, teardown and the startup purge now share one edit_container_hosts
helper that edits the bind-mounted file from the host side, and enumeration
moved to docker ps -aq. The path comes from docker inspect {{.HostsPath}}
rather than a hardcoded /var/lib/docker/... — that assumption breaks under a
custom data-root, a snap install, or rootless docker. The write is in place:
the container sees the file through a bind mount on the inode, so temp-file +
rename would detach its view.

Fixes #147.