forwardPorts: actuate on image and build sources (currently informational) #7

Today cfg.ForwardPorts is parsed and surfaced in ResolvedConfig but never actuated. For image and build sources we should add PortBindings to the run spec so a user's forwardPorts: [3000] actually exposes the port on the host.

Compose source stays informational by design (compose has its own ports: directive; design/compose.md §10.3 / decision §10.3 in compose design doc).

Plan

• Extend runtime.RunSpec with PortBindings []PortBinding
• Map ResolvedConfig.ForwardPorts → HostConfig.PortBindings for image / build sources in buildRunSpec
• Honor PortsAttributes.OnAutoForward for the bind shape (notify vs silent)
• Default to Host: 0 (any free host port) when caller didn't specify; document
• Test: end-to-end integration against image source + a port; assert docker port <id> shows the binding