feat: file log sink and Compose worker log collection

[aykoooo]

What & why

Finish remaining TASK 1 LOGS: optional file tee of stderr JSONL, and host-side Compose collection so pipeline runs can join worker logs.

Verify still exits 0 if a log sink fails. Host CLI and cache-sweep honor AIBOM_RUN_ID when set. Compose workers use an explicit json-file driver; collect with docker compose logs --no-log-prefix worker.

Fixes #42

Two commits: file sink first, then collect / AIBOM_RUN_ID.

Test plan

• Happy path: test_cli_log_file_tee_does_not_change_stdout (file JSONL == stderr; stdout still VerificationResult)
• Happy path: test_cli_honors_aibom_run_id_on_every_line (and sweep equivalent)
• Collect config: test_worker_uses_json_file_logging_driver (YAML pin; no live Docker in CI)
• uv run ruff check . / uv run ruff format --check . / uv run ty check / uv run pytest -m "not network" (175 passed)
• uv run pytest -m network (2 passed)
• Live: local + Compose verify with AIBOM_LOG_FILE / AIBOM_RUN_ID; collect with docker compose logs --no-log-prefix worker

Out of scope / follow-ups

• In-app syslog client and OpenShift collection (Epic: TASK 1 — LOGS (file sink + collect telemetry) #42 cuts)
• Orchestration / queue product (Epic: TASK 2 — host-pipeline job contract #43)
• SSH localhost python vs python3 default