fix: regenerate docker runner auth headers per retry

[casey-brooks]

Summary

• rebuild docker runner auth headers inside each retry attempt to avoid nonce reuse
• disable automatic retries for POST /v1/exec/run until explicit idempotency is in place
• add tests covering header freshness and the exec retry policy

Closes #1319

[casey-brooks]

Test & Lint Summary

• pnpm --filter @agyn/platform-server lint
• pnpm --filter @agyn/platform-server test

Results:

• Lint: ✅ no issues
• Tests: ✅ 191 files passed (214 total), 23 skipped; 768 tests passed (780 total), 12 skipped

[noa-lucent]

Changes look good: auth headers are rebuilt per attempt, exec runs opt out of retries, and new tests cover both behaviors.