chore: add COW solver Docker handoff

[acedward]

Depends on #48.

Summary

• Adds a conventional Docker-only COW solver handoff under docker/cow-solver/, with zero net changes under packages/*.
• Uses a two-stage source-run image with exactly four Docker COPY instructions, a frozen filtered production install, pinned Bun bases, numeric non-root execution, and no exposed application port.
• Uses an exclusion-based, service-specific Dockerfile.dockerignore; a future Offer Files backend will own its own adjacent Dockerfile and Dockerfile.dockerignore under docker/offer-files-backend/.
• Defaults directly to the existing preview entrypoint and documents the explicit direct mainnet command override, operator-supplied configuration, and preview dry-run-first workflow.
• Keeps the Offer Files backend, Midnight node, indexer, proof server, and relay external to the solver image.

Verification

• Independent no-cache native Docker build: PASS with the frozen 435-package solver closure.
• Two disabled --network none --read-only starts: PASS for default preview and explicit mainnet override.
• Two inverse network/entrypoint mismatch guards: PASS with the expected nonzero failures.
• Locked Midnight Node 1.x / ledger-v8 closure, image configuration/history, non-root ownership, no-port boundary, CA trust, secret/residue scan, and scoped cleanup: PASS.
• Independent implementation audit: PASS with zero blockers.

No image was published or deployed.