forwardPorts: actuate on image and build sources (currently informational)

Today `cfg.ForwardPorts` is parsed and surfaced in `ResolvedConfig` but never actuated. For image and build sources we should add `PortBindings` to the run spec so a user's `forwardPorts: [3000]` actually exposes the port on the host.

Compose source stays informational by design (compose has its own `ports:` directive; design/compose.md §10.3 / decision §10.3 in compose design doc).

### Plan

- Extend `runtime.RunSpec` with `PortBindings []PortBinding`
- Map `ResolvedConfig.ForwardPorts` → `HostConfig.PortBindings` for image / build sources in `buildRunSpec`
- Honor `PortsAttributes.OnAutoForward` for the bind shape (`notify` vs `silent`)
- Default to `Host: 0` (any free host port) when caller didn't specify; document
- Test: end-to-end integration against image source + a port; assert `docker port ` shows the binding