feat(render): label docker containers and networks created by render

[jcogilvie]

Description of your changes

Docker resources created by crossplane render carried no labels, so leftovers (after kill -9, crashes, CI timeouts, or deliberate Orphan / runtime-docker-name reuse) could not be reliably identified or swept.

This PR adds labels, purely additively:

• render.crossplane.io/managed-by: crossplane on Function containers, the crossplane internal render engine container, and the temporary crossplane-render-* network.
• render.crossplane.io/cleanup: <Stop|Remove|Orphan> on Function containers, recording the effective cleanup policy.

Label keys are exported constants (LabelKeyManagedBy, LabelValueManagedByCrossplane, LabelKeyCleanup) next to the existing annotation constants. A new docker.RunWithLabels option plumbs labels into docker.RunContainer. No exported signatures change.

Note: a pre-existing named container (runtime-docker-name) that gets reused is not relabeled, because Docker can't change labels on an existing container. It only gets labels if render creates it.

Tests: unit tests for functionContainerLabels and RunWithLabels. createContainer / createRenderNetwork talk to a real Docker client, so they aren't unit tested directly.

Follow-ups (not in this PR):

• A per-invocation render.crossplane.io/session ID label to scope cleanup to one run.
• An optional PID label.
• A cleanup/sweep command that uses these labels.

Fixes #401

I have:

• Read and followed Crossplane's contribution process.
• Run ./nix.sh flake check to ensure this PR is ready for review. (nix isn't installed; I ran go build ./..., go test ./cmd/crossplane/render/... ./internal/..., and golangci-lint run on the touched packages instead)
• Added or updated unit tests.
• Linked a PR or a docs tracking issue to document this change.
• Added backport release-x.y labels to auto-backport this PR.

Need help with this checklist? See the cheat sheet.

🤖 Generated with Claude Code