fix(dogfood/coder): add shutdown script and graceful agent shutdown (#17110)

By stopping Docker, we can hopefully avoid errors like this:

```
2025-03-26 12:14:53.280+02:00 Error: Error deleting container aa313fca0f72e59d4571afec898392e0ae34567d56c0ad15554c87394d2ca1e1: Error response from daemon: container aa313fca0f72e59d4571afec898392e0ae34567d56c0ad15554c87394d2ca1e1: driver "overlay2" failed to remove root filesystem: unlinkat /var/data/docker/overlay2/2e8e509237c79ebec972cccae9867f3bd6f71d49d4ed68db1b5ba229c3a2ff62/diff/var/lib/docker/overlay2/9c7c4ab0187ece1ca270d146090a8e852808996279d103cb394b2821c472af4c/diff/usr/lib/python3/dist-packages/ansible_collections: directory not empty
```

dogfood/coder/main.tf

@@ -357,6 +357,14 @@ resource "coder_agent" "dev" {
     cd "${local.repo_dir}" && make clean
     cd "${local.repo_dir}/site" && pnpm install
   EOT
+
+  shutdown_script = <<-EOT
+    #!/usr/bin/env bash
+    set -eux -o pipefail
+
+    # Stop the Docker service to prevent errors during workspace destroy.
+    sudo service docker stop
+  EOT
 }
 
 # Add a cost so we get some quota usage in dev.coder.com
@@ -418,6 +426,10 @@ resource "docker_container" "workspace" {
   # CPU limits are unnecessary since Docker will load balance automatically
   memory  = data.coder_workspace_owner.me.name == "code-asher" ? 65536 : 32768
   runtime = "sysbox-runc"
+  # Ensure the workspace is given time to execute shutdown scripts.
+  destroy_grace_seconds = 60
+  stop_timeout          = 60
+  stop_signal           = "SIGINT"
   env = [
     "CODER_AGENT_TOKEN=${coder_agent.dev.token}",
     "USE_CAP_NET_ADMIN=true",