Godoc pass over the exported surface

[Lutherwaves]

Why

pkg/docker and pkg/preview carry good explanatory comments internally, but the exported surface has not had a deliberate pass for readers arriving via pkg.go.dev.

For a library, the godoc is the documentation for most people — they will read it before the README and instead of the source. It is worth treating as a deliverable rather than a side effect.

Scope

• every exported type, function, method and error has a doc comment
• comments start with the identifier's name, so pkg.go.dev renders them properly
• package-level docs on pkg/docker and pkg/preview explaining what the package is for and how it relates to pkg/sandbox
• runnable Example functions for the paths people actually start with: create a sandbox, exec, round-trip a file, mint a preview link
• document the contract, not the mechanism — particularly which errors callers are expected to branch on, such as the sentinel returned when the required runtime is unavailable

Worth stating explicitly in the docs

Two behaviours are easy to get wrong and are currently only discoverable by reading the source:

• preview revocation is best-effort by construction. Verification is a local HMAC check that consults no shared state, so a revocation only holds in the process that recorded it. Expiry is the guarantee; revocation is a convenience.
• the image contract — a shell, a non-root default user, and a TCP forwarder for the preview relay. A caller passing their own image needs this, and today it lives only in image/README.md.