This PR includes the following improvements:

• Turning the demo cert request lazily, which won't block the guest-agent start on failure.
• Turn on panic = abort for the workspace to avoid lock state inconsitent when thread panicking.
• Make sure the /var/run/{dstack,tappd}.sock exists before start dockerd. This avoid the docker creating a directory for it. (which might cause the error below)

dstack-guest-agent[1258]: Error: Failed to bind on unix:/var/run/dstack.sock: Is a directory (os error 21)