ci: backend-agnostic integration guards + per-backend preflight

Integration tests now select their backend from BOT_BOTTLE_BACKEND and
skip on the capability that backend actually needs, instead of gating
every backend on unrelated Docker availability.

Task 1 — backend-agnostic guards (tests/_backend.py):
- Capability probes: docker_capability() (reachable daemon) and
  firecracker_capability() (accessible /dev/kvm + firecracker on PATH,
  Docker-independent). backend_capability()/selected_backend() resolve
  the target from BOT_BOTTLE_BACKEND (default docker).
- skip_unless_selected_backend_available() for backend-agnostic tests
  (test_sandbox_escape) — runs through whichever backend is selected and
  checks that backend's real capability.
- skip_unless_backend("docker") for Docker-implementation tests
  (DockerBroker, DockerGateway, backend.docker.*) — they no-op under a
  non-Docker run rather than testing internals that run doesn't target.
- Retires tests/_docker.py; the KVM job no longer needs SKIP_DOCKER_TESTS
  to steer Docker-only classes.

Task 2 — explicit per-backend skip visibility:
- tests/backend_preflight.py prints a clear PASS/FAIL capability line and
  exits non-zero when the selected backend is missing.
- Both integration jobs run it as a preflight, so absent infrastructure
  is surfaced at the job level instead of hidden among unittest.skip
  lines. The docker job replaces its soft "Show environment" step; the
  firecracker job keeps its richer backend-status check.

Docs (tests/README.md, docs/ci.md) updated; unit coverage for the probes,
guards, and preflight in test_backend_skip_guards.py.

Closes #414

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/backend_preflight.py

@@ -0,0 +1,27 @@
+"""Backend capability preflight for the integration CI jobs.
+
+Run as ``python3 -m tests.backend_preflight`` (optionally with a backend name
+argument; default: ``BOT_BOTTLE_BACKEND`` or ``docker``). Prints a single
+clear PASS/FAIL line for the selected backend's capability and exits non-zero
+on failure, so a job surfaces missing infrastructure at the job level instead
+of hiding it among ``unittest.skip`` lines further down the output.
+"""
+
+from __future__ import annotations
+
+import sys
+
+from tests._backend import backend_capability, selected_backend
+
+
+def main(argv: list[str] | None = None) -> int:
+    argv = sys.argv[1:] if argv is None else argv
+    backend = argv[0] if argv else selected_backend()
+    cap = backend_capability(backend)
+    status = "PASS" if cap.ok else "FAIL"
+    print(f"[preflight] backend={backend} {status}: {cap.detail}")
+    return 0 if cap.ok else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())