fix(docker): preserve provisioning failure status

[elezar]

Summary

Preserve the explicit Docker provisioning failure while a transient container state is observed during cleanup, so invalid CDI requests report Docker's CDI error deterministically.

Related Issue

No issue required: localized CI-discovered lifecycle status race with focused regression coverage.

Changes

• Keep explicit pending provisioning failures authoritative over transient Docker container snapshots.
• Retain normal container state precedence while provisioning is still in progress.
• Cover failure and non-failure reconciliation paths.

Testing

• Failing CI reproductions:
  • gpu-e2e / E2E Docker GPU (wsl-amd64), job 95793176038
  • gpu-e2e / E2E Docker GPU (wsl-amd64), job 103338318740
• git diff --check passes
• mise run pre-commit (unavailable: mise is not installed in this workspace)
• Unit tests (Rust tooling is unavailable in this workspace)
• E2E tests (not run; covered by CI)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-2830.docs.buildwithfern.com/openshell

[github-actions]

Label test:e2e applied for 97d40b8. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[elezar]

/ok-to-test 97d40b8

[github-actions]

This pull request has had no activity for 14 days and is now marked stale. It may be closed in 7 days if there is no further activity.

[github-actions]

Label test:e2e-gpu applied for 7b9ebeb. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute GPU E2E after building the required supervisor image once. The matching required CI gate status on this PR will flip green automatically once the run finishes.