style: pass explicit check= to every subprocess.run call

Silences pylint W1510 / ruff PLW1510 across the codebase. The choice
at each site reflects existing intent:

- check=True where the caller implicitly trusts success (docker ps /
  network ls returning stdout, docker build, exec chown/chmod inside
  provisioners).
- check=False where the caller inspects .returncode (race-retry on
  docker run, pipelock sidecar lifecycle, network plumbing, exec_claude
  propagating the session's exit code, best-effort cleanup paths).

No behavior change; check= defaults to False so the False sites are
semantically identical.

tests/integration/test_orphan_cleanup.py

@@ -34,6 +34,7 @@ class TestOrphanCleanup(unittest.TestCase):
                     ["docker", "network", "rm", n],
                     stdout=subprocess.DEVNULL,
                     stderr=subprocess.DEVNULL,
+                    check=False,
                 )
 
     def test_remove_missing_is_noop(self):
@@ -51,7 +52,7 @@ class TestOrphanCleanup(unittest.TestCase):
 
         nets = subprocess.run(
             ["docker", "network", "ls", "--format", "{{.Name}}"],
-            capture_output=True, text=True,
+            capture_output=True, text=True, check=True,
         ).stdout.splitlines()
         self.assertIn(self.internal_name, nets)
         self.assertIn(self.egress_name, nets)
@@ -61,7 +62,7 @@ class TestOrphanCleanup(unittest.TestCase):
 
         nets_after = subprocess.run(
             ["docker", "network", "ls", "--format", "{{.Name}}"],
-            capture_output=True, text=True,
+            capture_output=True, text=True, check=True,
         ).stdout.splitlines()
         self.assertNotIn(self.internal_name, nets_after)
         self.assertNotIn(self.egress_name, nets_after)