Extract and consolidate the container infrastructure from #63670 so the Windows action runner can use common helpers. This is roadmap step 10, based on master after #64054 merged.

• `container_engine.py` selects Linux Docker engines and handles WSL startup/recovery while preserving native context and host routing. `container_mounts.py` owns action mount layout and input visibility checks.
• `bazel/hermetic_container/container_paths.py` provides pure Windows destination and WSL source conversion for action containers, wrapper-hook volumes, and the standalone whole-command runner. Callers supply the mount prefix and destination drive-case policy; the standalone package includes the helper.
• `container_action.py` supplies the common file lock for container startup, config publication, whole-command coordination, and Podman recovery. Config/recovery callers require a real lock; Windows contention retries remain shared. Linux/macOS wrappers and distro helpers also share name sanitization.
• Shared preflight streams a NUL-separated path manifest through Docker's archive API, checks inputs in one detached probe, and reads an atomic result. Upload, polling, and cleanup share the visibility deadline, avoiding Windows command-line limits and per-input Docker processes.
• The macOS action wrapper adopts shared lifecycle/transport and rejects invisible inputs before executing tools. Bazel Python libraries declare the shared dependencies; regressions cover lock contention, platform path policies, standalone imports, manifest transport/deadlines, and output/exit-code replay.

The cross build remains opt-in with existing environment names and mount layouts. Windows runner integration follows as the next dependent extraction; Docker/Podman selection and whole-command configuration retain their distinct caller policies. Native Windows validation remains pending.