feat(test): add --dry-run for zero-infrastructure local contract testing

[Caesarsage]

PR description

Adds microcks test --dry-run: run a contract test with no pre-existing infrastructure — no running Microcks server, no Keycloak credentials, no upfront import. The CLI spins up an ephemeral Microcks container via microcks.io/testcontainers-go, imports the artifact, runs the test against your endpoint, prints the result, and tears the container down (or keep running and view on the UI when you pass the --watch flag).

microcks test --dry-run \
  --artifact ./openapi.yaml \
  "Pastry API:1.0.0" \
  http://localhost:3000 \
  OPEN_API_SCHEMA

New flags (all scoped to --dry-run)

Flag	Default	Purpose
--dry-run	false	Activate the ephemeral-container path
--artifact	(required)	Spec file imported as main artifact
--image	…/microcks-uber:latest-native	Image override (must be *-native)
--ready-timeout	90s	Wait for the container to be ready
--watch	false	Re-import + re-run the test on artifact change (TDD loop)

How it works

• Container lifecycle wrapped in signal.NotifyContext(SIGINT, SIGTERM) with a deferred Terminate, so the container is removed on every exit path including Ctrl+C.
• A localhost/127.0.0.1 test endpoint is auto-exposed to the container and rewritten to the host gateway (host.testcontainers.internal), so the documented example works as-is.
• Reuses the existing create-test-and-poll engine (extracted into runTestAndWait, cmd/testExecutor.go) — the dry-run path produces the same TestResult flow as the normal path, it doesn't fork it.
• --watch keeps one container alive across saves; an invalid spec mid-edit logs and keeps watching rather than killing the loop.
• The test-result UI link is only printed where the server outlives the run (persistent-server path, and during a watch session) — never in one-shot, where the container is gone and the link would 404.

Validation

• --artifact and --watch error clearly if used without --dry-run.
• Non-*-native --image fails fast (the auth-disabled native image is required for the zero-config path).

Refactors (per RFC §7)

• Extracted the poll/render loop from cmd/test.go into a shared runTestAndWait (cmd/testExecutor.go) used by both paths.

Tests

• Unit tests for option validation, the image-flavor guard, and the localhost-endpoint rewrite (cmd/testDryRun_test.go).
• Manually verified end-to-end on Docker: passing contract → success: true, exit 0; non-conforming target → exit 1; container removed within seconds of exit; wrong image flavor fails fast; --watch re-runs on save with a live details link and tears down cleanly on Ctrl+C.

Follow-ups (separate PRs in this stack)

• Docker + watch-mode integration tests
• Podman driver parity (auto-detect, socket resolution, Ryuk handling)
• Cross-platform CI matrix

Design doc: https://docs.google.com/document/d/1_V15WjMPyKYZQHpoYDFm71iRh-pwdhZeo0g9vj0ugs0/edit?usp=sharing

Refs #255

[Caesarsage]

The License Compliance failure is MPL-2.0 from adding testcontainers-go