Classify protected Dokploy runtime log failures

[cbusillo]

Summary

• classify runtime-log candidates by bounded JSON/non-JSON counts and fixed provider error kinds without returning line content
• inspect provider-error markers only on non-JSON provider text
• fail activation proof closed whenever any recognized provider error is present, even alongside a retained success event
• document the exact response and error-kind contract

Why

The exact deployed worker image is running, but protected Dokploy inspection returns one candidate line that is not any allow-listed worker lifecycle event. The self-bootstrap target is not tracked, so the tracked-target log workflow cannot resolve it. This bounded classification identifies whether the provider is returning an unsupported logging-driver or command error without exposing raw logs, container config, or secrets.

Validation

• focused runtime evidence, target inspection, and HTTP tests (28 tests)
• uv run --extra dev launchplane ci unittest-shard local (3,080 targets; 12/12 shards)
• uv run --extra dev mypy control_plane tests (759 files)
• changed-file Ruff and format checks
• production image build
• independent final exact-diff review approved
• JetBrains reported one pre-existing Markdown table warning at docs/privileged-operations.md:47, outside this diff

Refs #2219