Docker default repo + keep stderr in worker error_text

Two live-test findings in one fix:
1. DockerExecutor has no repo fallback: when a project has no
repo_url, worker leaves task['repo'] unset and the container
host.py dispatch fails instantly with 'missing --repo' because
host-config-docker.json had no repo field either. Add the host
test-repo as the config default; projects with repo_url still
override it via worker's explicit --repo.
2. Worker discarded stderr from the final error_text, so every
container/host crash surfaced only as the generic 'host
execution failed' and was undebuggable from the task record.
When stdout is empty, error_text now keeps the stderr tail
(last 1000 chars, where the real error line lives).

cloud/tests/test_fallback_retry.py

@@ -324,6 +324,28 @@ class FallbackRetryTestCase(unittest.TestCase):
         self.assertEqual(len(self.calls), 1)
         self.assertEqual(result["events"], [])
 
+    def test_crash_without_code_error_text_keeps_stderr(self):
+        # stdout 为空、stderr 有真实报错时，最终 error_text 必须
+        # 留住 stderr，不能被通用的 host execution failed 盖掉
+        # （主机实测：缺 repo 的 1 秒失败曾因此完全无法排障）。
+        def fake(cmd):
+            return SimpleNamespace(
+                returncode=1, stdout="",
+                stderr="Traceback (most recent call last):\n"
+                       "RuntimeError: 缺少 --repo，也没有在 host-config.json 里配 repo")
+
+        _insert_task(self.db_path, "A")
+        worker = self._worker(
+            runner=self._recording(fake),
+            model="gpt-6.1-sol",
+            fallback_models=["gpt-6-sol"],
+            max_retries=0)
+        result = worker.run_one()
+        self.assertEqual(result["status"], "failed")
+        row, cost, audits = _execution(self.db_path, "A")
+        self.assertIn("缺少 --repo", row[0])
+        self.assertEqual(result["events"], [])
+
 
 if __name__ == "__main__":
     unittest.main()