[ARC/DinD] Support tcp:// DOCKER_HOST natively instead of requiring unix socket workaround

## Problem

AWF's `src/docker-host.ts` deletes any non-`unix://` DOCKER_HOST value, falling back to `/var/run/docker.sock`. On ARC RunnerScaleSet pods, the canonical Docker endpoint is `tcp://localhost:2375` (DinD sidecar), and no unix socket exists in the runner container by default.

gh-aw's probe logic (added in recent versions) attempts to auto-detect `--docker-host-path-prefix` for tcp:// hosts, but AWF itself rejects the tcp:// value before it can be used.

## Current Workaround

Users must:
1. Create a shared volume (`dind-sock`) between runner and DinD containers
2. Configure DinD to also expose a unix socket on that volume
3. Set `engine.env.DOCKER_HOST: unix:///dind-sock/docker.sock` in workflow frontmatter

## Expected Behavior

gh-aw + AWF should handle `DOCKER_HOST=tcp://localhost:2375` natively:
1. gh-aw passes the tcp:// value through to AWF via `--docker-host` flag or stdin-config
2. AWF uses tcp:// for its own docker/compose orchestration
3. The agent container gets the appropriate DOCKER_HOST for its own DinD access (if `--enable-dind` is set)

## Context

- Upstream report: https://github.com/github/gh-aw/issues/34896 (gap G3)
- AWF tracking issue: [gh-aw-firewall#4830](https://github.com/github/gh-aw-firewall/issues/4830)
- AWF source: `src/docker-host.ts` line 44-48
- gh-aw version tested: v0.79.5 / AWF v0.27.1
- Antoine's workaround comment: https://github.com/github/gh-aw/issues/34896#issuecomment-4660896285