Class DockerExecExecutor

Runs harness processes via docker exec into an already-running per-run container.

Environment is passed with repeated --env flags rather than baked into the container at start, so a credential rotated between turns takes effect on the next turn without recreating the sandbox.