Consolidate Container-only fields (dockerfile, buildContextPath, customDockerBuildArgs) into a containerConfig object

### Summary

With aws/agentcore-cli#1284, Container agents now have **three** flat, Container-only fields on `AgentEnvSpec`: `dockerfile`, `buildContextPath`, and `customDockerBuildArgs` — plus cross-cutting "only allowed for Container builds" validators for each.

Both `AgentEnvSpecSchema` copies (CLI and `@aws/agentcore-cdk`) already carry a standing comment near the validators:

> `If adding more Container-specific fields, consider consolidating into a containerConfig object (see networkConfig pattern)`

We've now hit that threshold. This tracks grouping them under a single optional object:

```ts
containerConfig?: {
dockerfile?: string;
buildContextPath?: string;
customDockerBuildArgs?: Record;
}
```

### Benefits

- One `build !== 'Container' && data.containerConfig` check instead of three per-field validators.
- Future container-only options land inside `containerConfig` with no new cross-cutting validators.
- Clearer grouping in the schema and docs (mirrors the existing `networkConfig` pattern).

### Why it's deferred

This is a **breaking schema change**: it moves the already-shipped `dockerfile` field, touches every consumer, existing user `agentcore.json` files, and asset snapshots — and would have ballooned a contributor PR. Better as its own scoped change (with a migration note / back-compat shim if we want to keep accepting the flat form for a release).

### Scope

- CLI: `src/schema/schemas/agent-env.ts` (+ compacted mirror), consumers (`packaging/container.ts`, `dev/config.ts`, `dev/container-dev-server.ts`, `deploy/preflight.ts`), docs, snapshots.
- `@aws/agentcore-cdk`: `src/schema/schemas/agent-env.ts` (+ compacted mirror), `AgentEnvironment`, `ContainerSourceAsset`.

Ref: review comment on aws/agentcore-cli#1284.

Read the two AgentEnvSpec schema files and the existing networkConfig pattern first, then trace the listed CLI and CDK consumers: packaging/container.ts, dev/config.ts, dev/container-dev-server.ts, deploy/preflight.ts, AgentEnvironment, and ContainerSourceAsset. Done means the container-only fields are grouped consistently, docs and asset snapshots are updated, and the migration note or back-compat decision is addressed.

Written by the indexing model from the issue text.