docker-sbx fixes from the first real deployment

[czpython]

Deployment tests on a real host (Ubuntu 24.04, sbx v0.38.0) found three problems. This PR fixes them.

Problems and fixes

1. Port publish failed. The daemon rejects --publish IP::22 and port 0: it cannot select a free port on an explicit address. The provider now publishes with a bare 22. The daemon then selects a free loopback port. The provider always returns 127.0.0.1 as the SSH host, the same as the docker provider. The DOCKER_SBX_ADVERTISE_HOST setting is removed. A drukbox container reaches the sandboxes through host networking, which the documented recipe already uses.
2. The sandbox container stopped immediately. The template made /run/sshd only at image build. /run is a fresh tmpfs at start, thus sshd found no privilege-separation directory and stopped. The entrypoint now makes the directory at start. Plain docker run hid this problem because Docker keeps the image's /run content.
3. The daemon could not find a local template. The daemon has its own image store and pulls unknown names from a registry (the create failed with 403 from Docker Hub). docs/deploy.md now shows the required steps: docker save and sbx template load.

Verification

• uv run ruff check / format --check: pass
• uv run pyright: 0 errors
• uv run pytest: 381 tests pass
• End-to-end on the deployment host: in progress; results follow in a comment.

[czpython]

End-to-end results from the deployment host (Ubuntu 24.04, Exoscale, nested KVM, sbx v0.38.0, this branch):

• POST /hosts: 201, host active in ~35 s. SSH with the returned key works. The microVM has its own kernel (7.0.12). Caller env is in /etc/environment.
• POST /hosts/{id}/renew: 200. DELETE /hosts/{id}: 204, and the sandbox is gone from sbx ls.
• Warm pool: one pool tick provisions the warm host; a default POST /hosts then claims it in 0.04 s.
• Deployment shape: host mode per docs (systemd units for sandboxd, the API, and the janitor/pool timers).

Two observations for follow-up issues:

1. /doctor's provider probe times out: every sbx invocation costs ~3 s of CLI startup work, and the check budget is 5 s (DEFAULT_CHECK_TIMEOUT_SECONDS). The probe fails on a healthy daemon.
2. The minimal images/sbx/ template has no Docker CLI or dockerd, so docker-in-sandbox — a headline sbx feature — is not available on these hosts. The template needs the docker packages if hosts must run containers.

[czpython]

Follow-up 1 from the comment above is now fixed in this PR (da90605): the provider owns its /doctor probe time limit, the same ownership pattern as diagnose_hint. The docker-sbx provider sets 15 seconds; all other providers keep the 5-second default. Verified on the deployment host: /doctor reports ok: true with the provider probe at 8.7 s.