T2 executor: one fresh container per run, step spans, state, resume, CLI

Commands reach Docker in WSL through stdin, so no quoting breaks. cwd and exported env persist between steps. state.json is written after every step and --resume replays passed steps into a new container. Live tests: 14 pass, no containers left behind.