fix(docker): preserve provisioning failure status

[elezar]

Summary

Preserve the explicit Docker provisioning failure while a transient container state is observed during cleanup, so invalid CDI requests report Docker's CDI error deterministically.

Related Issue

No issue required: localized CI-discovered lifecycle status race with focused regression coverage.

Changes

• Keep explicit pending provisioning failures authoritative over transient Docker container snapshots.
• Retain normal container state precedence while provisioning is still in progress.
• Cover failure and non-failure reconciliation paths.

Testing

• Failing CI reproduction: gpu-e2e / E2E Docker GPU (wsl-amd64), job 95793176038
• git diff --check passes
• mise run pre-commit (unavailable: mise is not installed in this workspace)
• Unit tests (Rust tooling is unavailable in this workspace)
• E2E tests (not run; covered by CI)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-2830.docs.buildwithfern.com/openshell

[github-actions]

Label test:e2e applied for 97d40b8. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[elezar]

/ok-to-test 97d40b8