worker: cover goal docker paths with prestart stage logging

PR #145 added docker_run_* lines only to _run_in_container, but
goal/goal-resume/goal-resume-breakpoint call _call_runner directly
(to keep full stdout for goal conclusions), so the production live
test (a goal task) produced zero docker_run_ lines. Extract a
_docker_call_staged helper and route all four task paths through it;
error lines log the class name then re-raise so each caller's
kill+failed handling is unchanged.

Also fix audit attribution: audit_log has no task_id column, and
worker_exec_done/error details carried no task id, so per-task
queries missed them (the rows existed). All three exec details now
start with task_id=. Tests: 2 new goal-path stage cases + a done
detail task-id assertion (8 total in test_prestart_stages).

cloud/sandbox.py

@@ -1113,6 +1113,37 @@ class DockerExecutor(Executor):
             raise RuntimeError(
                 "docker runner 不支持 env，无法按名注入任务密钥")
 
+    def _docker_call_staged(self, task, cmd, timeout=None, env=None):
+        """带分段日志的 docker run 调用（2026-10-29 任务 A 补漏）。
+
+        goal/goal-resume/goal-resume-breakpoint 不走 _run_in_container
+        （直接调 _call_runner 保完整 stdout 结论），上一批只给
+        _run_in_container 加的标记漏了这三条真正在用的路径——
+        生产实测任务就是 goal 路径，日志里一条 docker_run_ 都没有。
+        本 helper 统一四条任务路径的开始/结束/异常行；异常只记
+        类名后原样重抛，各调用点的 kill+failed 处理不变。只记
+        容器名与镜像，绝不记命令（内含 prompt）。
+        """
+        _t0 = time.time()
+        _DOCKER_LOGGER.info(
+            "docker_run_start container=%s image=%s",
+            self.container_name(task), self.image)
+        try:
+            result = self._call_runner(cmd, timeout=timeout, env=env)
+        except Exception as exc:
+            _DOCKER_LOGGER.warning(
+                "docker_run_error container=%s elapsed_ms=%d error=%s",
+                self.container_name(task),
+                int((time.time() - _t0) * 1000),
+                exc.__class__.__name__)
+            raise
+        _DOCKER_LOGGER.info(
+            "docker_run_done container=%s elapsed_ms=%d returncode=%s",
+            self.container_name(task),
+            int((time.time() - _t0) * 1000),
+            getattr(result, "returncode", None))
+        return result
+
     def list_containers(self, prefix="codex-"):
         """列出名字以 prefix 开头的容器（默认 codex-），失败返回 []。
 
@@ -1198,20 +1229,11 @@ class DockerExecutor(Executor):
                                      extra_mounts=extra_mounts,
                                      network=network,
                                      extra_env=extra_env)
-        _docker_t0 = time.time()
-        _DOCKER_LOGGER.info(
-            "docker_run_start container=%s image=%s",
-            self.container_name(task), self.image)
         try:
-            result = self._call_runner(
-                cmd, timeout=timeout,
+            result = self._docker_call_staged(
+                task, cmd, timeout=timeout,
                 env=self._docker_cli_env(extra_env))
         except Exception as exc:
-            _DOCKER_LOGGER.warning(
-                "docker_run_error container=%s elapsed_ms=%d error=%s",
-                self.container_name(task),
-                int((time.time() - _docker_t0) * 1000),
-                exc.__class__.__name__)
             if exc.__class__.__name__ == "TimeoutExpired":
                 self.kill_container(task)
                 return {
@@ -1231,11 +1253,6 @@ class DockerExecutor(Executor):
         parsed = _parse_host_result(task_id, fake)
         parsed["executor"] = "docker"
         parsed["container"] = self.container_name(task)
-        _DOCKER_LOGGER.info(
-            "docker_run_done container=%s elapsed_ms=%d returncode=%s",
-            self.container_name(task),
-            int((time.time() - _docker_t0) * 1000),
-            parsed.get("returncode"))
         return parsed
 
     def dispatch_task(self, task, timeout=None, extra_mounts=None,
@@ -1357,8 +1374,8 @@ class DockerExecutor(Executor):
                                      network=network,
                                      extra_env=extra_env)
         try:
-            result = self._call_runner(
-                cmd, timeout=timeout,
+            result = self._docker_call_staged(
+                task, cmd, timeout=timeout,
                 env=self._docker_cli_env(extra_env))
         except Exception as exc:
             if exc.__class__.__name__ == "TimeoutExpired":
@@ -1472,8 +1489,8 @@ class DockerExecutor(Executor):
                                      network=network,
                                      extra_env=extra_env)
         try:
-            result = self._call_runner(
-                cmd, timeout=timeout,
+            result = self._docker_call_staged(
+                task, cmd, timeout=timeout,
                 env=self._docker_cli_env(extra_env))
         except Exception as exc:
             if exc.__class__.__name__ == "TimeoutExpired":
@@ -1582,8 +1599,8 @@ class DockerExecutor(Executor):
                                      network=network,
                                      extra_env=extra_env)
         try:
-            result = self._call_runner(
-                cmd, timeout=timeout,
+            result = self._docker_call_staged(
+                task, cmd, timeout=timeout,
                 env=self._docker_cli_env(extra_env))
         except Exception as exc:
             if exc.__class__.__name__ == "TimeoutExpired":