Fix two Entire Trail findings: secret retry loop, Windows-only Docker default

Trail 3 review found that a needs_secret step with its key already in the allowlist retried the same command until the budget ran out. The key is in the container from the start, so FirstRun now stops and says the key is likely invalid. It also found that the Docker command defaulted to the author's WSL setup. FirstRun now uses docker from PATH and falls back to WSL only on Windows.