Protect active container directories during scheduled file cleanup

FileCleanupTask can delete files or empty directories belonging to running containers when retention thresholds are met. Query running Docker containers before cleanup, exclude each target path container subtree, and fail closed when container discovery is unavailable or untrusted.

Start at FileCleanupTask and trace its scheduled cleanup flow and Docker container discovery. Verify how target paths are identified and how discovery failures are handled. Done means running-container subtrees are protected from deletion and unavailable or untrusted discovery prevents cleanup.

Written by the indexing model from the issue text.