feat(root04): author Containers & Docker

Adds all 8 ROOT 04 modules (why containers exist, images & containers, Docker CLI, container
networking, container storage, Dockerfile & image build, Docker Compose, containers →
Kubernetes) — 43 activities, using the nested Docker Engine Phase 6D built and tested. Modules
1, 2, and 8 are conceptual (no lab by design) — the honest bridge module (M8) explicitly names
what Kubernetes adds beyond what this course already taught, without re-teaching Kubernetes
itself.

Adds 5 new hands-on Docker scenarios plus 2 MCQs, all against the real nested Docker Engine:
docker-cli-basics (run/exec/inspect a real container), docker-container-networking (a genuine
"works internally, unreachable from host" port-publishing failure, diagnosed and fixed by
recreating the container with the correct `-p` flag), docker-container-storage (a real
destroy/recreate cycle proving named-volume persistence, not just described), docker-build-image
(a real Dockerfile, a real build, a real custom image run), and docker-compose-multiservice (a
real two-service Compose application with a real published port). All tested end-to-end via the
real scenario-validation API, including negative tests.

Wires rootnode-containers-assessment (2 required + 4 random-draw scenarios) using the existing
Phase 3B assessment engine.

This completes the entire ROOT_ Foundations sequence (ROOT 01-04) — see
docs/PHASE6E_ROOT_FOUNDATIONS_COMPLETION.md.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

scenarios/data/docker-image-vs-container-mcq.json

@@ -0,0 +1,22 @@
+{
+  "id": "docker-image-vs-container-mcq",
+  "title": "Image vs. Container — The Distinction That Confuses Everyone at First",
+  "category": "Containers",
+  "isolation_type": "shared_namespace",
+  "difficulty": "Easy",
+  "type": "mcq",
+  "weight": 3,
+  "description": "## Image vs. Container — The Distinction That Confuses Everyone at First\n\nYou run `docker run nginx:alpine` three separate times without removing anything in between. How many containers now exist, and how many images?",
+  "options": [
+    { "id": "a", "text": "3 containers, 3 images — each run creates its own independent image" },
+    { "id": "b", "text": "3 containers, 1 image — the image is the packaged artifact pulled once; each `run` creates a new, independent RUNNING INSTANCE from it" },
+    { "id": "c", "text": "1 container, 1 image — running the same image twice just reuses the same container" },
+    { "id": "d", "text": "1 container, 3 images — Docker versions the image automatically on each run" }
+  ],
+  "correct_option": "b",
+  "explanation": "An image is packaged, read-only artifact — pulling `nginx:alpine` downloads it exactly once. A container is a RUNNING INSTANCE of an image; running the same image multiple times creates multiple independent containers (with their own writable layer, network identity, and lifecycle), all sharing the same underlying image.",
+  "hints": [],
+  "setup_commands": [],
+  "default_namespace": "default",
+  "teardown_commands": []
+}