Stop leaking helper containers that fail to start (0.66.1)

docker-py's containers.run(remove=True) only removes a container after it
ran. A helper whose start failed - an NFS destination refusing the mount -
stayed behind in "Created", holding the destination's volume. Every Test
click and scheduled backup added one (a user found 18), the volume could
not be deleted even with everything stopped, and changed mount options
never took effect because the volume could not be recreated with them.

- docker_client.run_container: create, start, wait, collect output and
  always remove, also when the start fails; pulls a missing image. Used
  for NFS destination I/O, bind-path inspection, the volume wipe before a
  restore and the Trivy scanner.
- Every helper container is labelled stackpilot.helper; on startup the
  stopped ones are removed, together with anything left on an NFS
  destination volume by older versions.
- When an NFS destination's options change, stopped containers holding
  its volume are removed before it is recreated; a running one is now a
  clear error instead of silently keeping the old options.
- A refused mount explains itself: NFS enabled and reachable from the
  Docker host, NFSv3 needing rpcbind and mountd, and nfsvers=4 needing
  only port 2049.
- The scanner waits for Trivy's own 10-minute timeout instead of giving
  up after the default client's 60 seconds.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/tests/test_backup_restore.py

@@ -648,6 +648,8 @@ def test_download_removes_its_temp_file(stack, as_admin, db):
 
 
 class _HelperClient:
+    """Stands in for the helper container that runs the inspection script."""
+
     def __init__(self, output: str):
         self.output = output
         self.images = self
@@ -656,8 +658,20 @@ class _HelperClient:
     def get(self, image):
         return object()
 
-    def run(self, image, command, **kwargs):
-        return self.output.encode()
+    def create(self, image, **kwargs):
+        return self
+
+    def start(self):
+        pass
+
+    def wait(self, timeout=None):
+        return {"StatusCode": 0}
+
+    def logs(self, stdout=True, stderr=True):
+        return self.output.encode() if stdout else b""
+
+    def remove(self, force=False):
+        pass
 
 
 def test_inspect_paths_flags_remote_and_unmeasured(monkeypatch):