Move persistent-container config publication, locking, image preparation, and preflight from `cross/linux.py` into `container_actions.py`, preserving the existing Linux protocol and action strategies. Add `container_action.py` for detached command output/status transport, cancellation, renewable leases, and process locks so subsequent platform runners can share these primitives.

Docker requests are bounded by action/helper/cancellation deadlines. Failed log retrieval retries within a deadline and returns a transport error while retaining the container log, preventing silent success with lost output.

Extracted from #63670 as an independent PR targeting master. Windows runner adoption and engine/mount recovery follow in separate PRs.