fix: move network attachment from orchestrator to executor

Docker's connectToNetworkCmd needs the network ID (not name) and the
container's network sandbox must be ready. Moving network connection
to DeploymentExecutor where DockerNetworkManager handles ID resolution
and the container is already started.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cameleer3-server-app/src/main/java/com/cameleer3/server/app/runtime/DeploymentExecutor.java

@@ -135,6 +135,11 @@ public class DeploymentExecutor {
                 String containerId = orchestrator.startContainer(request);
                 newContainerIds.add(containerId);
 
+                // Connect to environment network after container is started
+                if (networkManager != null && envNet != null) {
+                    networkManager.connectContainer(containerId, envNet);
+                }
+
                 replicaStates.add(Map.of(
                         "index", i,
                         "containerId", containerId,

cameleer3-server-app/src/main/java/com/cameleer3/server/app/runtime/DockerRuntimeOrchestrator.java

@@ -100,15 +100,6 @@ public class DockerRuntimeOrchestrator implements RuntimeOrchestrator {
         var container = createCmd.exec();
         dockerClient.startContainerCmd(container.getId()).exec();
 
-        if (request.additionalNetworks() != null) {
-            for (String net : request.additionalNetworks()) {
-                dockerClient.connectToNetworkCmd()
-                        .withContainerId(container.getId())
-                        .withNetworkId(net)
-                        .exec();
-            }
-        }
-
         log.info("Started container {} ({})", request.containerName(), container.getId());
         return container.getId();
     }