Structure kernel prepare stage with event delivery guarantee

Refactor the prepare phase of create_kernel() (image pull, resource allocation, scratch, network, mounts) into Handlers under agent/stage/kernel_lifecycle/docker/. Each handler RETURNS A RESPONSE ONLY - no event emission. Local phase transitions: -> PREPARING, PREPARING -> PULLING.

Internal work is agent-local (local logging/metrics) and is not carried in events. On failure, tear down acquired resources in reverse order and return a FAILED response.

Do NOT emit KernelPreparingAnycastEvent / KernelPullingAnycastEvent from the handlers - transitions are reported by the transition-event layer (BA-6851).

Success Criteria:
- [ ] Each prepare sub-stage runs through its own handler
- [ ] Handlers return responses only (no event emission)
- [ ] Failure tears down acquired resources in reverse order and returns FAILED
- [ ] pants test passes for affected packages

JIRA Issue: BA-6078