Fix worker directory cleanup

[pmbstyle]

Summary

• pre-create Docker worker bind-mount targets inside ephemeral worker directories so Docker does not leave root-owned mountpoint folders behind
• add a Docker-backed cleanup fallback for stale root-owned worker leftovers when normal removal fails
• cover cleanup retries/fallbacks and Docker launcher mount target preparation with focused tests