fix(docker): install docker CLI for box backend; bump to 4.10.0-beta.3

The langbot_box service drives sandbox containers through the docker CLI
(CLISandboxBackend shells out to `docker run`/`docker exec`), but the
image shipped without a docker client, so DockerBackend.is_available()
was always false and the Box sandbox backend was unavailable in Docker
deployments — disabling native tools, skill execution and stdio MCP.
Install docker-ce-cli (client only) in the image, arch-aware so
multi-arch builds work.

Also bump langbot-plugin pin to 0.4.1, which disables proxy
auto-detection on internal control-plane WebSocket connections (the
langbot<->plugin_runtime / langbot<->box handshakes were failing on
hosts that inject a proxy into containers).

Bumps version to 4.10.0-beta.3.

Dockerfile

@@ -14,10 +14,22 @@ COPY . .
 
 COPY --from=node /app/web/dist ./web/dist
 
-RUN apt update \
-    && apt install gcc -y \
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends gcc ca-certificates curl gnupg \
+    # Install the Docker CLI (client only) so the optional langbot_box
+    # service can drive the mounted host Docker socket and create sandbox
+    # containers. The same image powers langbot / plugin_runtime / box; only
+    # box uses the client. Arch-aware via dpkg so multi-arch builds work.
+    && install -m 0755 -d /etc/apt/keyrings \
+    && curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc \
+    && chmod a+r /etc/apt/keyrings/docker.asc \
+    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo \"$VERSION_CODENAME\") stable" > /etc/apt/sources.list.d/docker.list \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends docker-ce-cli \
     && python -m pip install --no-cache-dir uv \
     && uv sync \
+    && apt-get purge -y --auto-remove curl gnupg \
+    && rm -rf /var/lib/apt/lists/* \
     && touch /.dockerenv
 
 CMD [ "uv", "run", "--no-sync", "main.py" ]