Werkdock skeleton: doctor, load, run over the bwrap engine (Go)

The minimal build-capable CLI decided in RFC 0002's outcome: stdlib-only
Go module, one static binary.

- engine: RunSpec behind the Engine interface (RFC 0001); the Bwrap
  engine ports Werkator's hardened invocation — uid-0 mapping, read-only
  rootfs at /, proc/dev/tmp/root before the user binds so binds below
  them land inside, mountpoint pre-creation in the rootfs including file
  mountpoints, and a guard against binds escaping the rootfs. --clearenv
  gives docker-style clean environments (HOME/PATH set explicitly).
- store: images under $WERKDOCK_HOME (default ~/.werkdock), load
  unpacks via the tar CLI into a tmp dir and renames atomically.
- cli: docker-shaped run flags (-v/-e/-w/--rm); refused docker flags
  (-p, --network, --memory, --cpus, --user, -d) fail loudly with the
  reason; exit codes follow docker (125 CLI errors, child code through).
- doctor: port of werkator-build-prerequisites.sh — userns probe with
  the three signals, tar/zstd, free space and group-quota headroom via
  testable df/quota parsers, same PASS/FAIL output.
- tests: argv golden test, mountpoint and escape tests, flag refusals,
  store round trip, doctor parsers — plus real-sandbox integration
  tests that skip where bwrap or userns are unavailable.

Also records in step 21: RFC 0002 levels 2/3 deferred; next goal is
sandbox builds of Werkator, Werkbaum, and Werkdock itself.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

internal/engine/engine.go

@@ -0,0 +1,37 @@
+// Package engine executes sandboxed commands. The CLI verbs are thin
+// frontends over this package, so a later daemon can expose the same
+// logic without duplicating it (RFC 0002).
+package engine
+
+// Bind is one bind mount, applied in order; later mounts shadow earlier
+// ones at their own path, exactly as bwrap layers them.
+type Bind struct {
+	Source   string
+	Dest     string
+	ReadOnly bool
+}
+
+// EnvVar is one environment variable; order is preserved.
+type EnvVar struct {
+	Key   string
+	Value string
+}
+
+// RunSpec describes one sandboxed command, independent of the engine
+// that executes it.
+type RunSpec struct {
+	// RootFS is the absolute path to the unpacked image rootfs,
+	// bound read-only at /.
+	RootFS  string
+	Binds   []Bind
+	Env     []EnvVar
+	Workdir string
+	Command []string
+}
+
+// Engine runs a RunSpec and reports the command's exit code.
+// bwrap is the first engine; native namespaces may become a second
+// (RFC 0001).
+type Engine interface {
+	Run(spec RunSpec) (int, error)
+}