style: pass explicit check= to every subprocess.run call

Silences pylint W1510 / ruff PLW1510 across the codebase. The choice
at each site reflects existing intent:

- check=True where the caller implicitly trusts success (docker ps /
  network ls returning stdout, docker build, exec chown/chmod inside
  provisioners).
- check=False where the caller inspects .returncode (race-retry on
  docker run, pipelock sidecar lifecycle, network plumbing, exec_claude
  propagating the session's exit code, best-effort cleanup paths).

No behavior change; check= defaults to False so the False sites are
semantically identical.

claude_bottle/backend/docker/util.py

@@ -33,6 +33,7 @@ def runsc_available() -> bool:
         ["docker", "info", "--format", "{{json .Runtimes}}"],
         capture_output=True,
         text=True,
+        check=False,
     )
     return r.returncode == 0 and "runsc" in r.stdout
 
@@ -58,6 +59,7 @@ def container_exists(name: str) -> bool:
         ["docker", "ps", "-a", "-q", "-f", f"name=^{name}$"],
         capture_output=True,
         text=True,
+        check=True,
     )
     return bool(result.stdout.strip())
 
@@ -129,4 +131,5 @@ def _silent_run(cmd: Iterable[str]) -> int:
         list(cmd),
         stdout=subprocess.DEVNULL,
         stderr=subprocess.DEVNULL,
+        check=False,
     ).returncode