feat: pluggable runner support via DI composition root overrides

[rorybyrne]

Motivation

OSA's runner infrastructure (hooks, sources) is currently wired to Docker/OCI via OciProvider. Deployers who run OSA in environments without a Docker daemon — or who want to use a different container orchestrator — have no way to swap the runner implementations without forking.

The domain layer already uses clean Protocol-based ports (HookRunner, SourceRunner), and the DI system (Dishka) supports "last provider wins" semantics. The composition root just needs to accept external providers so downstream consumers can override bindings.

Scope

• create_container() accepts *extra_providers — extra Dishka providers appended after defaults, overriding any overlapping bindings
• create_app() accepts an optional container_factory callable, allowing callers to supply a pre-configured container
• Zero-arg calls remain unchanged — existing deployments and tests are unaffected

Non-goals

• This issue does not implement any specific alternative runner (e.g. Kubernetes Jobs). It only exposes the seam.
• No runtime feature flags or conditional logic in OSA itself.

Related

• feat: replace direct Docker socket mount with socket proxy #71 — Docker socket proxy (alternative for Docker-based deployments)
• feat: S3-backed file storage adapter #88 — S3 file storage (alternative storage backends face the same override need)
• refactor: replace APScheduler for scheduled source runs #39 — Replace APScheduler for scheduled source runs