fix(bootstrap): remove implicit Docker install

[vishr]

Summary

• remove the unaudited get.docker.com installer from bootstrap
• run the authored provisioning hook inside the lock, fence, and journal boundary before verifying Docker
• document the explicit Docker prerequisite and add refusal, ordering, and concurrency coverage

Validation

• just check
• just lint
• go test -race ./internal/engine
• focused bootstrap tests
• typos and git diff --check

Closes #84