feat(preflight): host/toolchain validation + VERSIONS pin-file — T01

- VERSIONS: 7 container images (CONTRACT_003 §3.2) + 13 host tools, KEY=value,
  source-able+greppable; images carry :PIN_DIGEST placeholders with a documented
  pin-digests procedure (D5 determinism — no real deploy until pinned).
- preflight.sh: fails closed (non-zero on any required check), bash-3.2 safe,
  composable checks/ (versions,tools,env,docker) + gated (ssh,dns) that WARN-skip
  until the stack is configured.
- env check honors D2 (passphrase presence only, never printed).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

preflight/checks/docker.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# -----------------------------------------------------------------------------
+# checks/docker.sh — the Docker daemon is reachable.
+#   `docker info` must succeed (CONTRACT_003: the whole egg is Docker containers;
+#   the Pulumi @pulumi/docker provider needs a reachable daemon — locally for the
+#   CLI sanity check here, over SSH at deploy time).
+#   Exits non-zero if the docker CLI is missing or the daemon is unreachable.
+# -----------------------------------------------------------------------------
+set -euo pipefail
+PF_DIR=$(cd "$(dirname "$0")/.." && pwd)
+# shellcheck source=../lib/common.sh
+. "$PF_DIR/lib/common.sh"
+
+echo "[docker] docker daemon reachable"
+
+if ! pf_have docker; then
+  pf_fail "docker CLI not installed (see tools check)"
+  pf_summary "docker"
+  exit $?
+fi
+
+if docker info >/dev/null 2>&1; then
+  ctx=$(docker context show 2>/dev/null || echo "default")
+  pf_pass "docker daemon reachable (context: $ctx)"
+else
+  pf_fail "docker daemon NOT reachable ('docker info' failed) — is Docker Desktop / the engine running?"
+fi
+
+pf_summary "docker"