style: pass explicit check= to every subprocess.run call

Silences pylint W1510 / ruff PLW1510 across the codebase. The choice
at each site reflects existing intent:

- check=True where the caller implicitly trusts success (docker ps /
  network ls returning stdout, docker build, exec chown/chmod inside
  provisioners).
- check=False where the caller inspects .returncode (race-retry on
  docker run, pipelock sidecar lifecycle, network plumbing, exec_claude
  propagating the session's exit code, best-effort cleanup paths).

No behavior change; check= defaults to False so the False sites are
semantically identical.

tests/canaries/test_pipelock_image.py

@@ -27,6 +27,7 @@ class TestPipelockImage(unittest.TestCase):
             ["docker", "pull", PIPELOCK_IMAGE],
             stdout=subprocess.DEVNULL,
             stderr=subprocess.DEVNULL,
+            check=False,
         )
         if result.returncode != 0:
             raise unittest.SkipTest(f"could not pull {PIPELOCK_IMAGE}")
@@ -34,7 +35,7 @@ class TestPipelockImage(unittest.TestCase):
     def test_binary_runs(self):
         result = subprocess.run(
             ["docker", "run", "--rm", PIPELOCK_IMAGE, "--version"],
-            capture_output=True, text=True,
+            capture_output=True, text=True, check=False,
         )
         out = result.stdout + result.stderr
         self.assertRegex(out, r"[Pp]ipelock|2\.[0-9]+\.[0-9]+")