test: make Docker suites hermetic

[sbalabanov]

Summary

• cross-compile container service binaries through Bazel and expose explicit Docker test-context filegroups
• resolve Compose files only from declared runfiles and stage minimal temporary Docker build contexts
• remove repository-root discovery plus MODULE.bazel / go.mod marker data dependencies
• make Docker test targets declare network access and remove pre-build Make prerequisites
• derive test image names from declared input contents to keep caching deterministic

Sandbox evaluation

The Docker suites already run under Bazel's sandboxed strategy (processwrapper-sandbox locally). I did not enable Bazel's experimental hermetic Linux sandbox globally: it omits the host root and would require nonportable mounts for the Docker CLI, plugin, socket, shared libraries, and certificate/config paths. The tests now get source inputs only through Bazel runfiles while retaining the host Docker boundary they inherently require.

Validation

• make build
• make test
• make integration-test
• make e2e-test
• make lint
• make check-tidy
• make check-gazelle

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[sbalabanov]

Closed in lieu of #439 , a separate PR will come to address fixes from here