fix: Rate-limit removed container event warnings and resolve by ID

[rdwr-egore]

Summary

• Resolve Docker event targets by immutable container ID, with a fallback for ID-less legacy events.
• Use the resolved container's current name for incident state and OOM / recovery handling, preventing events from a renamed instance from mutating the state of a new container using its previous name.
• Cache missing container IDs for 60 seconds: suppress duplicate Docker inspect calls and log warnings, with hard eviction at 1,024 entries.
• Keep the existing crash/health monitoring and alert rules unchanged.

Reproduction and validation

• 12/12 regression tests passed in the watchdog runtime image (original 5 + 7 event tests).
• Replaying 110 late unhealthy/die events for one removed container now results in 1 Docker lookup and 2 warnings.
• Added controlled-clock tests for expiry and cache eviction, an ID-less event fallback test, and a rename/name-reuse incident-state test.
• Lab 218: exercised a real removed container `die` event, replayed it 25 times, and observed 1 lookup / 1 warning. Isolated test container was removed after testing.
• Syntax and git diff checks passed. GitHub CI is responsible for the remaining build/compose checks.

Scope and limitations

• Production watchdog deployments were not changed.
• The fast auto-removed-container crash-detection gap predates this PR and is not fixed here. Follow up separately with appropriate planned-operation/ephemeral-container suppression.
• Existing poll/event unhealthy-cycle accounting is outside this PR.