Reuse the shared aiodocker client in DockerKernel methods

[rapsealk]

Parent epic: #11216
Follow-up to: #11218 / #11226

Main idea

PR #11226 routed every per-op Docker() instantiation through a shared long-lived client except in DockerKernel, because plumbing the shared client through would change DockerKernel.__init__'s contract. The remaining throwaway connections are:

• src/ai/backend/agent/docker/kernel.py:121 — get_logs()
• src/ai/backend/agent/docker/kernel.py:224 — commit() (bare Docker(), not even closing_async — also worth fixing for correctness)
• src/ai/backend/agent/docker/kernel.py:327 — download_file()
• src/ai/backend/agent/docker/kernel.py:356 — download_single()
• src/ai/backend/agent/docker/kernel.py:486 — module-level prepare_krunner_env_impl() (separate case — not a DockerKernel method)

Design

• Add docker: Docker as a keyword-only argument to DockerKernel.__init__, store on self.
• Update construction sites in DockerAgent (agent.py) to pass self.docker.
• Update the four DockerKernel methods above to use self.docker instead of async with closing_async(Docker()) / bare Docker().
• prepare_krunner_env_impl is a module-level function — evaluate the caller: if the caller has a shared Docker client handy, accept it as a parameter; otherwise leave it as-is and note why.
• Handle pickling: DockerKernel has __getstate__/__setstate__ for RPC marshalling — the docker field must NOT be pickled. Exclude it explicitly in __getstate__ and re-inject on restore (the agent can re-attach self.docker when materializing a kernel from persisted state).

Alternative ideas

• Instead of a constructor arg, expose a setter (kernel.attach_docker(self.docker)) called from DockerAgent. Slightly less explicit, but avoids touching __init__'s signature. Lower preference — constructor injection is clearer.
• Inject via a context var. Rejected — implicit and harder to reason about.

Anything else?

• monitor_docker_events() (in agent.py) must keep its own closing_async(Docker()) — it reconnects on stream drops. Do NOT touch.
• PersistentServiceContainer in docker/utils.py is bootstrap-time only; not part of this issue.

[rapsealk]

Closing as not planned.

On review:

1. The premise — "commit() uses a bare Docker(), not even closing_async — also worth fixing for correctness" — was inaccurate. commit() on main uses docker = Docker(); try: ...; finally: await docker.close(). That's verbose but correct — not a leak.
2. The broader extension of the shared aiodocker client from DockerAgent (issue Pool the Docker daemon connection in the agent #11218 / PR refactor(BA-5858): Reuse a long-lived aiodocker client across container operations #11226) into DockerKernel pays ongoing invariant-maintenance cost (pickling exclusion, recovery ordering, constructor plumbing through ~4 sites) for latency gains on methods that are not per-kernel-start hot path (get_logs, download_file, download_single, commit).
3. Aligning commit()'s style with the async with closing_async(...) pattern used elsewhere in docker/kernel.py is low-value and can be done organically on a future touch, not as its own issue/PR.

PR #11228 (scope-narrowed to just the commit() idiom change) closed alongside.