Add TLS, DNS, and many-exposed-ports integration tests for moby v29

Lachlan Grantrequested to merge
39536-docker-moby-v29-tls-dns-ports-tests into main

What does this MR do?

Adds three self-contained pieces of real-daemon integration test coverage for the moby v29 SDK migration (!6902 (merged)), split out from !6924 (merged) into a smaller, easier-to-review MR. No CI config changes -- everything here runs in the existing integration test job.

  1. TestDockerTLSConnection -- connects to the dind service over real TCP+TLS instead of the local unix socket CI normally uses, to exercise the real TLS handshake and certificate verification path in helpers/docker/options.go's configureTransport, which was rebuilt from scratch for v29 but only ever unit-tested with a stubbed dialer and fake certs.
  2. TestTLSFailsClosedOnMissingCerts -- fast unit test confirming client construction fails outright (not a silent insecure fallback) when TLS certs are missing/invalid.
  3. TestDockerCommand_DNSConfig -- runs a real container with a configured DNS server list and asserts the resulting /etc/resolv.conf matches.
  4. TestDockerServiceManyExposedPorts -- adds a new fixture image (tests/dockerfiles/many-exposed-ports, 25 EXPOSEd tcp ports), runs it as a real service, and independently inspects the container to confirm the v29 SDK's ExposedPorts type correctly parses real daemon data for services exposing more than the runner's 20-port healthcheck cap.

Why was this MR needed?

Docker is an essential component of the runner. These areas of the v29 migration (custom TLS transport, DNS config plumbing, exposed-port type parsing) were previously only covered by mocked unit tests.

What's the best way to test this MR?

Each test was run locally against a real Docker daemon before being committed, including a locally-run docker:27-dind with real generated certs for the TLS test -- see individual commit messages.

Merge request reports