refactor(workspace): remove legacy Docker/container challenge execution code

Delete crates/secure-container-runtime (Docker container management via
bollard, broker, protocol, WebSocket transport, security policies) and
crates/challenge-orchestrator (Docker-based challenge orchestration with
backend, lifecycle, evaluator, health, continuous monitoring).

Workspace and dependency changes:
- Remove secure-container-runtime from workspace members in Cargo.toml
- Remove secure-container-runtime dependency from validator-node

Challenge registry cleanup:
- Remove docker_image field from ChallengeEntry struct
- Remove docker_image parameter from ChallengeEntry::new()
- Change register() validation to require wasm_module (WASM-only)
- Remove DockerRegistry variant from DiscoverySource enum
- Remove docker_registries field from DiscoveryConfig
- Remove Docker deprecation warning from discover_all()
- Update all registry tests to use WasmModuleMetadata

Comment and documentation updates:
- Replace "WASM-first" with "WASM-only" across README, AGENTS.md, and docs
- Remove Docker Policy sections from README, validator.md, challenges.md
- Remove Test Harness Security (Docker) section from security.md
- Remove Testing With Docker section from challenge-integration.md
- Remove Challenge Orchestrator from integration architecture diagram
- Update stale Docker references in rpc-server, core, challenge-sdk comments
- Update test-comprehensive.sh to remove secure-container-runtime test phases
- Rewrite validator_wasm_audit.md to reflect completed cleanup

Author: echobt

AGENTS.md

@@ -169,7 +169,6 @@ flowchart TB
 - `crates/bittensor-integration` — Bittensor chain interaction
 - `crates/subnet-manager` — subnet management
 - `crates/rpc-server` — RPC server for validator API
-- `crates/secure-container-runtime` — sandboxed runtime (legacy Docker support)
 - `crates/p2p-consensus` — libp2p gossipsub + DHT consensus
 - `crates/wasm-runtime-interface` — WASM runtime host interface
 - `bins/validator-node` — main validator binary
@@ -178,9 +177,6 @@ flowchart TB
 - `bins/mock-subtensor` — mock Bittensor node for testing
 - `tests` — integration tests
 
-**Non-workspace crate** (exists on disk but not in workspace members):
-- `crates/challenge-orchestrator` — Docker-based challenge container orchestration (legacy)
-
 **Note:** Platform is fully decentralized—there is no central server. All validators communicate directly via libp2p (gossipsub + DHT).
 
 ---

Cargo.lock

@@ -10,7 +10,6 @@ members = [
     "crates/bittensor-integration",
     "crates/subnet-manager",
     "crates/rpc-server",
-    "crates/secure-container-runtime",
     "crates/p2p-consensus",
     "crates/wasm-runtime-interface",
     "crates/challenge-sdk-wasm",

Cargo.toml

@@ -20,13 +20,12 @@
 
 ## Overview
 
-Platform is a **WASM-first, peer-to-peer validator network** for deterministic evaluation of miner submissions on Bittensor. Validators execute challenge logic in a hardened WASM runtime, reach stake-weighted consensus over libp2p, and submit finalized weights to the chain. **Docker is reserved for local and CI test harnesses only.**
+Platform is a **WASM-only, peer-to-peer validator network** for deterministic evaluation of miner submissions on Bittensor. Validators execute challenge logic in a hardened WASM runtime, reach stake-weighted consensus over libp2p, and submit finalized weights to the chain.
 
 **Core principles**
 - Decentralized libp2p mesh (gossipsub + DHT) with no centralized relays.
 - Stake-weighted PBFT-style consensus for challenge state and weight aggregation.
 - Deterministic WASM execution with strict runtime policy and auditability.
-- Explicit separation of production runtime (WASM) and test-only containers (Docker).
 
 ---
 
@@ -165,13 +164,6 @@ See [Validator Operations](docs/operations/validator.md) for hardware, configura
 
 ---
 
-## Docker Policy
-
-- **Production**: WASM runtime only.
-- **Testing**: Docker-backed harnesses only (e.g., `./scripts/test-comprehensive.sh`).
-
----
-
 ## License
 
 MIT

README.md

@@ -16,7 +16,6 @@ platform-bittensor = { path = "../../crates/bittensor-integration" }
 platform-p2p-consensus = { path = "../../crates/p2p-consensus" }
 platform-distributed-storage = { path = "../../crates/distributed-storage" }
 platform-challenge-sdk = { path = "../../crates/challenge-sdk" }
-secure-container-runtime = { path = "../../crates/secure-container-runtime" }
 wasm-runtime-interface = { path = "../../crates/wasm-runtime-interface" }
 
 # Bittensor