wslc container cp has no container-to-stdout form

@ptrivedi is already working on this.

Since Aug 11, 2026.

**Is your feature request related to a problem? Please describe.**

`wslc container cp` documents three forms: local→container, container→local, and **stdin→container** (`-` as the source). There is no container→stdout counterpart — passing `-` as the destination produces no output. Data can be streamed *into* a container without touching the host filesystem, but cannot be streamed *out*.

Reading a file out therefore means materialising it on the host first: a writable temp location, cleanup on every failure path, and a name that cannot collide with a concurrent copy — all to read bytes the caller never wanted on disk.

**Describe the solution you'd like**

`wslc container cp CONTAINER:PATH -` writing the payload to stdout, mirroring the stdin form that already exists.

A tar stream would be the most useful shape. Its entry header carries type and size ahead of the content, so a caller can decide about a file before transferring it, and it distinguishes a symlink from a regular file.

**Describe alternatives you've considered**

- **`cp` to a host temp file, then read and delete it.** Works, and is what a caller must do today. It requires a writable host path, and the temp file is observable to anything else on the machine for as long as it exists.
- **`exec` with `cat` or `base64`.** Avoids the host filesystem, but requires the image to contain a shell and those utilities, which `cp` does not — so it fails on minimal and distroless images where `cp` succeeds.
- **`wslc container export`.** Exports the entire container filesystem; far too heavy for retrieving a single file.

**Additional context**

Environment: WSL 2.9.4.0, kernel 6.18.35.2-1, Microsoft Windows [Version 10.0.26220.8764].

The use case is programmatically retrieving a build artifact from a container inside a library that cannot assume the image contains a shell, and would rather not require a writable host path from its caller.