feat: cleanup pod dx

[luke-lombardi]

Summary by cubic

Improves pod DX and reliability with a first‑class Service for handlerless web/container deploys, smarter autoscaling and request queuing that wake up immediately when backends are ready, sturdier image builds/runtime defaults, and safer container state/index commits. Adds managed private pool capacity controls and stronger request‑token handling with heartbeat and explicit release.

• New Features

  • SDK/CLI: Added Service (auto‑detects ports from Dockerfile EXPOSE, defaults to 8000; supports --dockerfile/--image/--command and --port/--ports). Deploy without a handler. Container.attach now returns ContainerAttachResult and supports exit_on_error. Sandbox accepts a pool. CLI adds managed private pool capacity (list offers, launch/extend capacity, TTL, and budget guards).
  • Autoscaling/Pods: Clear keep‑warm semantics (−1/0/>0). Better desired container counts without Redis; enforce gateway MaxReplicas; skip stopping containers with active connections; non‑blocking event channels.
  • Networking/Proxy/Endpoints: Redis‑backed request tokens with heartbeat, TTL refresh while streaming, and explicit release; immediate wake‑up when backends become available; pooled copy buffers for proxy I/O.
  • Worker/Image: Persistent Buildah layer cache with safe fallback; default process CWD set to /; resilient image‑build streaming that emits a terminal failure if the build exits early.
  • URLs: Path URLs now use /pod/public/<id>/<PORT> for unauthenticated pods and /pod/id/<id>/<PORT> for authenticated pods (host‑style URLs unchanged).
  • Scheduler/Repository: Atomically commit container state and indexes in Redis to avoid list/stop races.

• Migration

  • keep_warm_seconds is now an int: −1 = keep running, 0 = scale to zero when idle, >0 = keep warm for N seconds. Update any configs that assumed an unsigned value. Functions no longer accept keep_warm_seconds.
  • If you use path URLs for pods, switch to /pod/public/<id>/<PORT> (unauth) or /pod/id/<id>/<PORT> (auth).
  • CLI: Use --port (repeatable) or --ports. Use --command for service entrypoints. You can deploy a Service without a handler.

^{Written for commit bb79171. Summary will update on new commits.}