Args:
    container_id: Container ID or name.
    tail: Number of lines to fetch from the end of the logs.
    since: Optional ISO 8601 timestamp; only return logs after this time.
    filter_keyword: Optional substring; only return lines containing it.

Returns:
    dict with container_id, log_lines, line_count, truncated.

Uses `docker stats --no-stream` for a point-in-time snapshot (this is not
a real heap dump — the name is aspirational). The container must be
running for stats to be available.

Args:
    container_id: Container ID or name.
    include_processes: If True, also runs `ps aux --sort=-%mem` inside
        the container and includes the output.

Returns:
    dict with cpu_percent, memory_mb, memory_limit_mb, memory_percent,
    and optionally processes (list of strings, one per ps line).

Validates container_id and blocks known-dangerous command patterns
before running anything. Enforces a hard timeout via asyncio so a
runaway command can never hang the server.

Args:
    container_id: Container ID or name.
    command: Shell command string to run (executed via `sh -c`).
    timeout_seconds: Max seconds to wait before killing the command.

Returns:
    dict with stdout, stderr, exit_code, timed_out.